{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c567b190-fc36-5ade-8de1-5e127c273063",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.1",
      "type": "library",
      "name": "@angular/core",
      "version": "15.2.9-tuxcare.1",
      "purl": "pkg:npm/%40angular/core@15.2.9-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:e9824022-4efc-5bb5-b491-233bb4e369db",
      "id": "CVE-2025-66035",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.2.9-tuxcare.1 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:da6e2e63-ba33-57ae-bd7c-9710f408bde4",
      "id": "CVE-2025-66412",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-66412 affects version 15.2.9-tuxcare.1 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7b0b049f-edb1-5623-a67a-f1c2126ba7f1",
      "id": "CVE-2026-22610",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22610 affects version 15.2.9-tuxcare.1 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:47b87321-fc1d-52c8-be14-cc18628e3281",
      "id": "CVE-2026-27970",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-27970 affects version 15.2.9-tuxcare.1 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fb4eea9e-0323-54b4-978c-7a385e8eb593",
      "id": "CVE-2026-41423",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.9-tuxcare.1 of @angular/core. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-41423. The SSRF vulnerability via protocol-relative URLs was introduced in Angular 17.0.0 when the codebase switched from Node.js url.parse to WHATWG URL API. Angular 15.2.9 still uses the legacy Node.js url.parse which treats protocol-relative URLs ('//evil.com') as pathnames, not hostname overrides, preventing the SSRF attack vector."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:37469976-1ba2-5b96-ac95-61b611f587d4",
      "id": "CVE-2026-46417",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-46417 affects version 15.2.9-tuxcare.1 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f2c57b80-4560-584c-9ba3-aaa9313973ce",
      "id": "CVE-2026-50168",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50168 affects version 15.2.9-tuxcare.1 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fa5b6714-caf3-5f70-8e62-817959b90890",
      "id": "CVE-2026-50169",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50169 affects version 15.2.9-tuxcare.1 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6f7b7d0f-c03f-5387-8bbb-e8e37eb7f84c",
      "id": "CVE-2026-50170",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.9-tuxcare.1 of @angular/core. not_affected \u2014 no evidence captured"
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d8546257-cbde-5059-b50f-9de98679301d",
      "id": "CVE-2026-50171",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50171 affects version 15.2.9-tuxcare.1 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a4eb3a73-10f9-5a10-8c31-5d1ade5b1e19",
      "id": "CVE-2026-50184",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50184 affects version 15.2.9-tuxcare.1 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:10daaeb2-58cc-5bac-90ae-d3ea2fe27275",
      "id": "CVE-2026-50555",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50555 affects version 15.2.9-tuxcare.1 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cf51d3c2-05eb-5ec0-ba17-eca96a138de6",
      "id": "CVE-2026-50556",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50556 affects version 15.2.9-tuxcare.1 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5e29ba91-2c03-52bc-a851-1e444f5a69c2",
      "id": "CVE-2026-50557",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50557 affects version 15.2.9-tuxcare.1 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:18abfab8-c242-5d5e-b048-0d56703233d9",
      "id": "CVE-2026-52725",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-52725 affects version 15.2.9-tuxcare.1 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f8631de5-93bf-558f-8724-0f99d9b2889a",
      "id": "CVE-2026-54264",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54264 affects version 15.2.9-tuxcare.1 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3d6543ca-44ea-56e4-8890-9d814303421c",
      "id": "CVE-2026-54265",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54265 does not affect version 15.2.9-tuxcare.1 of @angular/core. not_affected \u2014 Angular 15.2.9-tuxcare.1 is not affected by CVE-2026-54265. The vulnerability requires the new Ivy compiler 'pipeline' architecture with the TwoWayProperty IR operation, which was introduced in Angular 16+. Angular 15.2.9 uses the older compiler architecture where two-way bindings are desugared into separate property and event bindings, causing them to automatically receive the same sanitizatio..."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:682be44b-dc55-5f81-b2a5-6bba607e55ff",
      "id": "CVE-2026-54266",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.9-tuxcare.1 of @angular/core. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature does not exist in this version - it was introduced in Angular v16+. Without this feature, there is no code that hashes HTTP request properties for cache key generation, so the hash collision vulnerability cannot manifest."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:52f3201e-484e-5363-8f37-f8020b80a9a1",
      "id": "CVE-2026-54267",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54267 affects version 15.2.9-tuxcare.1 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f77da793-9570-5907-a4f5-0558c3d6870b",
      "id": "CVE-2026-54268",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54268 affects version 15.2.9-tuxcare.1 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.1"
    }
  ]
}