{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ae7c6a58-420c-5614-b3e9-655b8900a93b", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.3", "type": "library", "name": "@angular/benchpress", "version": "15.2.9-tuxcare.3", "purl": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:23b3dd57-635b-5aff-ae94-36d489bc85ca", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.2.9-tuxcare.3 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d1c6a2a8-1e43-54ff-9c04-96b675b6725e", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 15.2.9-tuxcare.3 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3d0990a1-16f0-5ca4-8db0-d8341c012509", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 15.2.9-tuxcare.3 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d3626f3e-77aa-5f50-a253-d35d55b1d788", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 15.2.9-tuxcare.3 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c2b566ea-020d-54ef-9a54-32a64432ea01", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.9-tuxcare.3 of @angular/benchpress. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-41423. The SSRF vulnerability via protocol-relative URLs was introduced in Angular 17.0.0 when the codebase switched from Node.js url.parse to WHATWG URL API. Angular 15.2.9 still uses the legacy Node.js url.parse which treats protocol-relative URLs ('//evil.com') as pathnames, not hostname overrides, preventing the SSRF attack vector." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:636d6f4a-ffee-5a5b-9d03-2304318735c6", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.2.9-tuxcare.3 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:79d2ddf0-a8b4-510d-aef8-95c575cf5568", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 15.2.9-tuxcare.3 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8790d225-8170-5642-8b82-1134e8baf759", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 15.2.9-tuxcare.3 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:35771af9-378d-5859-9bc8-2a0cd3c94d52", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.9-tuxcare.3 of @angular/benchpress. not_affected \u2014 no evidence captured" }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f032eaaa-b09e-5e4c-a575-91201481dd21", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.2.9-tuxcare.3 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:27666831-b87c-5f47-86e5-9cd435098070", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 15.2.9-tuxcare.3 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2237cc81-51d6-5a87-9fea-568efcd644f9", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.2.9-tuxcare.3 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9c14c6c2-373c-5506-bed5-23c079439804", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.2.9-tuxcare.3 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:73a7f607-e45a-5c98-aa27-072c50a37331", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 15.2.9-tuxcare.3 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3b3d81f2-6252-5b65-bcc5-54bf2d1828c8", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 15.2.9-tuxcare.3 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:852f3299-4c9f-5ab7-a71a-8dabe179d85c", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 15.2.9-tuxcare.3 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1538f941-e9e4-5d70-a0c2-57ef20fe511d", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.2.9-tuxcare.3 of @angular/benchpress. not_affected \u2014 Angular 15.2.9-tuxcare.1 is not affected by CVE-2026-54265. The vulnerability requires the new Ivy compiler 'pipeline' architecture with the TwoWayProperty IR operation, which was introduced in Angular 16+. Angular 15.2.9 uses the older compiler architecture where two-way bindings are desugared into separate property and event bindings, causing them to automatically receive the same sanitizatio..." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7a239061-869a-5a5e-a97b-9f422571d761", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.9-tuxcare.3 of @angular/benchpress. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature does not exist in this version - it was introduced in Angular v16+. Without this feature, there is no code that hashes HTTP request properties for cache key generation, so the hash collision vulnerability cannot manifest." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4ca3ef23-d616-551c-8156-60cf6e3719ad", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 15.2.9-tuxcare.3 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3972a1bf-b9da-5c0b-938e-2bf19b797696", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.2.9-tuxcare.3 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:baa2983e-2f55-57f6-a62b-71740cb81bad", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 15.2.9-tuxcare.3 of @angular/benchpress. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-68945. The vulnerability exists in the HttpTransferCache feature used during Server-Side Rendering (SSR), which generates cache keys from HTTP request parameters. However, this feature was not introduced until Angular 16.0.0. Angular 15.2.9 lacks the entire HttpTransferCache implementation: no transfer_cache.ts file exists, no HttpTransferCache class, ..." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:77b31006-fd91-5867-88c9-0ed933b3ff3b", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 15.2.9-tuxcare.3 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4f2bde3a-e313-516d-a5ed-bdf832b53f58", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 15.2.9-tuxcare.3 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.3" } ] }