{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:02756e94-57c7-5c39-a85d-6ff8c375d11f", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/compiler@15.2.2-tuxcare.3", "type": "library", "name": "@angular/compiler", "version": "15.2.2-tuxcare.3", "purl": "pkg:npm/%40angular/compiler@15.2.2-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:bdef5fd0-f22a-57dd-a402-06d7d5bed2ac", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.2.2-tuxcare.3 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c141661a-d4f1-57e6-8855-491eac5f6ac8", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 15.2.2-tuxcare.3 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9eea579e-d39b-50f5-b1a1-74fa4ec83229", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 15.2.2-tuxcare.3 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:805594c5-dfda-5038-b3f6-488f8ea844a7", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 15.2.2-tuxcare.3 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:51b91339-85c6-50d5-b022-d5692abdbdea", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.2-tuxcare.3 of @angular/compiler. not_affected \u2014 The target repository (Angular 15.2.2-tuxcare.1) is NOT affected by CVE-2026-41423. While the target lacks the specific fix from the upstream patch, it uses a fundamentally different URL parsing mechanism (Node.js legacy url.parse()) that does not exhibit the WHATWG URL specification behavior exploited in the vulnerability." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:669a398b-be73-5434-9177-85db6c30ed0f", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.2.2-tuxcare.3 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:32149c74-ac1a-502b-8da8-87f8d783f8fd", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 15.2.2-tuxcare.3 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7ea5a437-e50d-5b49-86d2-0704e3af47c6", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 15.2.2-tuxcare.3 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:36619563-20c5-575c-a300-5b3a71eaf9f1", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.2-tuxcare.3 of @angular/compiler. not_affected \u2014 Angular v15.2.2 is not affected by CVE-2026-50170. The HTTP TransferCache feature, which is the subject of the vulnerability, was introduced in Angular v16.0.0 (March 2023). The target repository version (15.2.2-tuxcare.1) predates this feature entirely and does not contain the vulnerable code path." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:48e74e3c-21c3-5bb8-bb68-57adfd649c60", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.2.2-tuxcare.3 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1fef13f6-75f4-5e39-a7c2-c4f07507c708", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 15.2.2-tuxcare.3 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2930f455-4a6e-531c-819a-14e928e71db4", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.2.2-tuxcare.3 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a6fb42f0-39c2-52a3-a90e-2278eefd699c", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.2.2-tuxcare.3 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a33c1b4a-4a18-5195-9628-5aeb554c55d5", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 15.2.2-tuxcare.3 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0416fa30-09f9-51f7-ba3a-6ae2be29a1b0", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 15.2.2-tuxcare.3 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:08d6418e-8718-5f2a-b556-2004dd03f145", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 15.2.2-tuxcare.3 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0df7c97a-5073-51af-9de3-0853646b1c35", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.2.2-tuxcare.3 of @angular/compiler. not_affected \u2014 Angular v15.2.2 does not contain the vulnerable code path. The CVE-2026-54265 vulnerability affects the template pipeline's resolve_sanitizers.ts (TwoWayProperty operation), which does not exist in v15.2.2. This version uses TemplateDefinitionBuilder where two-way bindings desugar to regular property bindings that receive identical sanitization as one-way bindings." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:416fcab0-e1c1-531e-a8f9-f2cb7c41f333", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.2-tuxcare.3 of @angular/compiler. not_affected \u2014 Angular 15.2.2 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature was introduced in Angular 16.0.0 (May 2023), after this version was released (March 2023). The target codebase does not contain the transfer_cache.ts module, HttpTransferCache API, or any HTTP response caching mechanism that uses hash-based cache keys." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:84b25698-9ec4-5ec5-9965-ebea4ce138b9", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 15.2.2-tuxcare.3 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:03c62bdc-7286-5ccd-929e-e73ffc7f1b23", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.2.2-tuxcare.3 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2fcc0751-6b65-5940-ba4a-0b139638f50e", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 15.2.2-tuxcare.3 of @angular/compiler. not_affected \u2014 Angular 15.2.2-tuxcare.2 is not affected by CVE-2026-68945. The vulnerable HttpTransferCache feature does not exist in this version\u2014it was introduced in Angular 16.0.0, after the target's release. Without HttpTransferCache, the cache-key collision vulnerability described in the CVE (where repeated HTTP parameters like `role=user&role=admin` collide with scalar-comma parameters like `role=user,a..." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6f03a81a-a299-5f1d-b039-dbdfc9f3287b", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 15.2.2-tuxcare.3 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:20d9c1b2-7ad5-56c6-b663-b2d4ebd57812", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 15.2.2-tuxcare.3 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@15.2.2-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler@15.2.2-tuxcare.3" } ] }