{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d19f1ead-1538-58a9-8531-2d559cbe6178", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/core@11.2.0-tuxcare.4", "type": "library", "name": "@angular/core", "version": "11.2.0-tuxcare.4", "purl": "pkg:npm/%40angular/core@11.2.0-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:e506feef-0def-5398-a8d7-d26a640578d4", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 11.2.0-tuxcare.4 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@11.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f8050119-4df9-5892-a223-3acb5e92b72d", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 11.2.0-tuxcare.4 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@11.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:af5568a5-5bfb-5723-888b-24a812218c3b", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 11.2.0-tuxcare.4 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@11.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1e7983d7-ccbb-5616-ab9d-ba50ba22e237", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 11.2.0-tuxcare.4 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@11.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:552cf788-d9df-5546-a521-8b92f4f1f629", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 11.2.0-tuxcare.4 of @angular/core. not_affected \u2014 Target version 11.2.0 uses Node.js url.parse() API which does not perform hostname hijacking with protocol-relative URLs. The SSRF vulnerability (CVE-2026-41423) specifically affects versions using WHATWG URL constructor without the defense. The target's url.parse() produces empty hostname for inputs like '//evil.com', preventing the SSRF exploitation that requires hostname replacement." }, "affects": [ { "ref": "pkg:npm/%40angular/core@11.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4805927b-ee28-5459-97f7-f4f39955f6a5", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 11.2.0-tuxcare.4 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@11.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b9336cc5-cef7-547f-b00f-f17874b9be14", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 11.2.0-tuxcare.4 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@11.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:25ad631c-e3b1-5832-ac3e-72eb31446600", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 11.2.0-tuxcare.4 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@11.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4c404ab9-e7d7-5a73-b8f6-c817f94b9115", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 11.2.0-tuxcare.4 of @angular/core. not_affected \u2014 Angular 11.2.0 is not affected by CVE-2026-50170. The vulnerability exists in Angular's HTTP transfer cache feature, which automatically caches HTTP responses during server-side rendering (SSR) and reuses them during client hydration. This feature was introduced in Angular v16+ and does not exist in Angular 11.2.0. The target repository lacks the vulnerable code path entirely: no transfer_cache..." }, "affects": [ { "ref": "pkg:npm/%40angular/core@11.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:95e9e838-537b-5a1a-a8fb-1ad3d7df3011", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 11.2.0-tuxcare.4 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@11.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e10a15a3-955e-504f-aca9-90df2968a3d2", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 11.2.0-tuxcare.4 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@11.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1d9555b3-625b-519f-a811-58ac8c90c648", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 11.2.0-tuxcare.4 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@11.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:cd6a73e4-a60a-5e15-a304-67aed3a2c318", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 11.2.0-tuxcare.4 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@11.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1d562513-bf91-5d7e-b788-181443b35792", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 11.2.0-tuxcare.4 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@11.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c26600e2-a721-5dbb-9b3d-0ceef8bcbab5", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 11.2.0-tuxcare.4 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@11.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3181f78c-0f2b-5572-842d-803179f9065a", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 11.2.0-tuxcare.4 of @angular/core. not_affected \u2014 Version 11.2.0-tuxcare.2 is NOT affected by CVE-2026-54264. This version lacks the vulnerable code pattern - asset-group requests are reconstructed using URL-only (no headers forwarded), and data-group requests use browser's native fetch which strips sensitive headers per Fetch specification. The vulnerability requires a header-copying mechanism that does not exist in this version." }, "affects": [ { "ref": "pkg:npm/%40angular/core@11.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0b1bd9e8-30d5-5e60-9686-a7698c856ed3", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 11.2.0-tuxcare.4 of @angular/core. not_affected \u2014 Angular v11.2.0-tuxcare.2 is NOT affected by CVE-2026-54265. The vulnerability requires the Ivy template compiler pipeline's TwoWayProperty IR operation introduced in later versions (v20+). This version uses an earlier compiler architecture (View Engine + early Ivy) where two-way property bindings are desugared through the same parsePropertyBinding() path as one-way bindings, applying schema-de..." }, "affects": [ { "ref": "pkg:npm/%40angular/core@11.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6576a96e-1e51-5577-905d-2959d2e8ad26", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 11.2.0-tuxcare.4 of @angular/core. not_affected \u2014 Angular v11.2.0 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature (introduced in Angular v16+) does not exist in this version. The transfer_cache.ts file and all related APIs (HttpTransferCache, generateHash, makeCacheKey, withHttpTransferCache) are completely absent from the codebase." }, "affects": [ { "ref": "pkg:npm/%40angular/core@11.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6307e0df-e53e-51b9-b336-8a587997ae84", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 11.2.0-tuxcare.4 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@11.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:dfd3bb28-3336-5544-93aa-2c53a500074b", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 11.2.0-tuxcare.4 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@11.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:23291b6f-faa6-5d40-96e4-fda54574bf96", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 11.2.0-tuxcare.4 of @angular/core. not_affected \u2014 Angular 11.2.0 is not affected by CVE-2026-68945. The vulnerability exists in HttpTransferCache, a feature for automatically caching HTTP requests during Server-Side Rendering (SSR). This feature does not exist in Angular 11.2.0. HttpTransferCache was introduced in Angular v16+ as part of the modernized SSR architecture. The target version predates this feature by multiple major releases. Only ..." }, "affects": [ { "ref": "pkg:npm/%40angular/core@11.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7643d1db-2a77-5734-a3b0-481a590bc239", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 11.2.0-tuxcare.4 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@11.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a7192ef9-9fa1-5fdd-8531-d6f599f2ef22", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 11.2.0-tuxcare.4 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@11.2.0-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/core@11.2.0-tuxcare.4" } ] }