{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7a9123d5-dc0b-57a6-98ce-b9902d7febe1", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.4", "type": "library", "name": "@angular/common", "version": "5.1.2-tuxcare.4", "purl": "pkg:npm/%40angular/common@5.1.2-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:86b7f506-cfe5-5e36-8bdf-f6f1fb2a557d", "id": "CVE-2021-4231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.1.2-tuxcare.4 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:677fdbef-8636-518d-ae03-a00546bc5c76", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.1.2-tuxcare.4 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3b6a0372-70a2-5d23-9167-4cdf448fb936", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.1.2-tuxcare.4 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:86d9afb0-720a-520a-8d19-141685a95be7", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.1.2-tuxcare.4 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:11499fc8-5748-5667-9cc7-7fc3dedc4254", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.1.2-tuxcare.4 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3456a603-a78d-5190-8733-d0ed6e8a68ea", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 5.1.2-tuxcare.4 of @angular/common. not_affected \u2014 Angular version 5.1.2 is not affected by CVE-2026-41423. The vulnerability requires the WHATWG URL API which exhibits hostname override behavior with protocol-relative URLs. The target uses Node.js's legacy url.parse() API which does not have this behavior." }, "affects": [ { "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:be81b31d-63c3-5f58-bd31-a5cb4a0d105e", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.1.2-tuxcare.4 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0e74bc61-0727-5fb7-95db-da31287e3a23", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.1.2-tuxcare.4 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:14d6042b-8b66-500f-a016-2083efef2c8a", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.1.2-tuxcare.4 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0c4a3ce6-4318-588c-a8a2-b68d6689c767", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 5.1.2-tuxcare.4 of @angular/common. not_affected \u2014 no evidence captured" }, "affects": [ { "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d8495400-cce3-5fef-a080-017f8fe0fd1c", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.1.2-tuxcare.4 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:72acfb91-a4d2-569e-b254-97bc952a2ade", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.1.2-tuxcare.4 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4250b323-3149-5d36-8a97-f5d55127e763", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.1.2-tuxcare.4 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c00962ee-61c2-5d63-81cd-22250460c8fc", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.1.2-tuxcare.4 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:36c5a240-9792-5096-8fcf-4c01f7630a3e", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.1.2-tuxcare.4 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:13299357-cf60-5223-a153-3c98636c8fb7", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.1.2-tuxcare.4 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9baa1b31-379c-5d92-b4e3-25b42b295433", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 5.1.2-tuxcare.4 of @angular/common. not_affected \u2014 Angular v5.1.2-tuxcare.1 is NOT affected by CVE-2026-54264. The vulnerability requires a `newRequestWithMetadata` function that copies request headers, which does not exist in this version. The service worker reconstructs asset requests from URLs only using bare `adapter.newRequest(url)` calls, never copying or forwarding request headers. Therefore, credential headers cannot be leaked on cross-..." }, "affects": [ { "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:db4f91ca-3a21-503d-8561-2d8c7fcc9aa0", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 5.1.2-tuxcare.4 of @angular/common. not_affected \u2014 Angular 5.1.2 uses the View Engine compiler architecture, which does not have the TwoWayProperty operation kind that is vulnerable in the Ivy compiler. In View Engine, two-way bindings desugar through the same parsePropertyBinding() code path as one-way bindings, ensuring both receive identical security context resolution and sanitization. The vulnerability pattern described in CVE-2026-54265 c..." }, "affects": [ { "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:bb8b698f-b490-5481-8a77-0052bede5a4f", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 5.1.2-tuxcare.4 of @angular/common. not_affected \u2014 Angular 5.1.2 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature that generates cache keys using a weak 32-bit DJB2 hash does not exist in this version. This feature was introduced in Angular v16+, while the target is v5.1.2. Although TransferState exists in this version for basic state transfer, there is no integration with HttpClient for automatic response caching, no..." }, "affects": [ { "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:73a53f2e-4940-5d87-9525-2f80888f0847", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.1.2-tuxcare.4 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:685042b7-7be8-588c-812a-328b184545ba", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.1.2-tuxcare.4 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f7a53776-fbc8-58e8-9fd5-eea4a6b659e8", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.1.2-tuxcare.4 of @angular/common. not_affected \u2014 Angular 5.1.2 is not affected by CVE-2026-68945. The vulnerable component HttpTransferCache does not exist in this version. HttpTransferCache was introduced in Angular v16 (circa 2022), while this target is Angular 5.1.2 (2017-2018 era). Although Angular 5.1.2 has TransferState for basic SSR state transfer and HttpClient with HttpParams, it lacks the HTTP response caching mechanism during SSR t..." }, "affects": [ { "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8c18b0fd-a195-5ea1-8133-bffa13c8d589", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.1.2-tuxcare.4 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:608c1504-1ced-5156-a360-8c6c088aeff6", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 5.1.2-tuxcare.4 of @angular/common." }, "affects": [ { "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.4" } ] }