{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:203b485b-f095-5886-a94f-2055f38d12f9", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.1", "type": "library", "name": "@angular/benchpress", "version": "15.2.9-tuxcare.1", "purl": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:87224cc8-521c-5ec2-9e27-c19b5c402eaa", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.2.9-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b8ac8bf1-3a43-571b-aaab-c24115880f76", "id": "CVE-2025-66412", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 15.2.9-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:72e0a8b3-1a2e-5e49-8086-b9a301b031c9", "id": "CVE-2026-22610", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 15.2.9-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c225837c-ba3d-5168-ade3-95c55eea00db", "id": "CVE-2026-27970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 15.2.9-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:92674659-e635-5302-8331-1fda5f54ce2d", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.9-tuxcare.1 of @angular/benchpress. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-41423. The SSRF vulnerability via protocol-relative URLs was introduced in Angular 17.0.0 when the codebase switched from Node.js url.parse to WHATWG URL API. Angular 15.2.9 still uses the legacy Node.js url.parse which treats protocol-relative URLs ('//evil.com') as pathnames, not hostname overrides, preventing the SSRF attack vector." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:59ccbb73-12b9-58dc-bc4d-abd7f6b87d81", "id": "CVE-2026-46417", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 15.2.9-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:168c5427-c16e-5cf5-89cc-de5cd5a6da53", "id": "CVE-2026-50168", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 15.2.9-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a80c1df8-3493-5a29-8d93-8b0e25cedaed", "id": "CVE-2026-50169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 15.2.9-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3444ac2b-1249-5fba-a8c3-a7b714af2469", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.9-tuxcare.1 of @angular/benchpress. not_affected \u2014 no evidence captured" }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:30b9f0db-45e8-57d0-b5f4-202be4973425", "id": "CVE-2026-50171", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 15.2.9-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a6a45fb8-3f90-5336-ae47-9b140d8362e9", "id": "CVE-2026-50184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 15.2.9-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:508fbcd4-9525-572a-a036-ca74a6d539dc", "id": "CVE-2026-50555", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 15.2.9-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:03685966-0cd2-5dd0-93bc-48e9ea5c04a1", "id": "CVE-2026-50556", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 15.2.9-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c2324beb-64a8-50d4-9e84-679d742512c2", "id": "CVE-2026-50557", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 15.2.9-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d382eeb3-82d6-53d2-8179-31fca592c017", "id": "CVE-2026-52725", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 15.2.9-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9db8dff1-e3cc-5a7a-8510-9b906ff23c66", "id": "CVE-2026-54264", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 15.2.9-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:64b5a342-ac8e-57ec-b76b-e324ee64f5a4", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.2.9-tuxcare.1 of @angular/benchpress. not_affected \u2014 Angular 15.2.9-tuxcare.1 is not affected by CVE-2026-54265. The vulnerability requires the new Ivy compiler 'pipeline' architecture with the TwoWayProperty IR operation, which was introduced in Angular 16+. Angular 15.2.9 uses the older compiler architecture where two-way bindings are desugared into separate property and event bindings, causing them to automatically receive the same sanitizatio..." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:eb56a0f9-e11b-55a9-b367-eeed4df565d3", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.9-tuxcare.1 of @angular/benchpress. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature does not exist in this version - it was introduced in Angular v16+. Without this feature, there is no code that hashes HTTP request properties for cache key generation, so the hash collision vulnerability cannot manifest." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:69add878-8bbe-5f3b-a3ba-5420ae289da0", "id": "CVE-2026-54267", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 15.2.9-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:156a2eff-c59f-5ec9-a704-9f83d0f7d215", "id": "CVE-2026-54268", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 15.2.9-tuxcare.1 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.1" } ] }