{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4534d029-42b5-5df7-b334-33d92e6939dc", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.3", "type": "library", "name": "@angular/core", "version": "15.2.9-tuxcare.3", "purl": "pkg:npm/%40angular/core@15.2.9-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:4860ab1c-93a5-5d6b-b398-258eec0a5071", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.2.9-tuxcare.3 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:03e6bb5c-2ddd-5207-9ed1-9f08d194d1c1", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 15.2.9-tuxcare.3 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b3415412-10fb-5b16-aa9e-3c2c85728029", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 15.2.9-tuxcare.3 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9c28c608-f2ea-5c9d-b420-7d2fc3bed57b", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 15.2.9-tuxcare.3 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a1485a7e-282c-5e36-88b1-7805745dad09", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.9-tuxcare.3 of @angular/core. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-41423. The SSRF vulnerability via protocol-relative URLs was introduced in Angular 17.0.0 when the codebase switched from Node.js url.parse to WHATWG URL API. Angular 15.2.9 still uses the legacy Node.js url.parse which treats protocol-relative URLs ('//evil.com') as pathnames, not hostname overrides, preventing the SSRF attack vector." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:673cbb81-54f6-58cb-843c-a8de14cc1f94", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.2.9-tuxcare.3 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c4d376b8-25e1-5d0a-b3e1-3a9a655b369e", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 15.2.9-tuxcare.3 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0ba56f31-5085-5583-954a-36c85ff8bf36", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 15.2.9-tuxcare.3 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a307d8cb-6344-5726-9d1f-646ac7d81e6c", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.9-tuxcare.3 of @angular/core. not_affected \u2014 no evidence captured" }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f0a4ac4a-71f1-5e5b-8613-ad106554e418", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.2.9-tuxcare.3 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:428aaea6-dc94-5a23-917a-c78cb39a4d88", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 15.2.9-tuxcare.3 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cebb8a3f-d6d0-57ca-a78b-3ae81f831a7b", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.2.9-tuxcare.3 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:eab84db9-f690-5f25-bbec-2acdfa3c6cb5", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.2.9-tuxcare.3 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:37cf07d9-7833-5732-8407-c3e63d74649c", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 15.2.9-tuxcare.3 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:404c9a78-d383-5467-9aa9-2f6c463c5f81", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 15.2.9-tuxcare.3 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cc6f8a6d-0323-5ae0-bbd5-5b56578998d8", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 15.2.9-tuxcare.3 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:be005d10-aad1-587c-a379-029413f596e6", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.2.9-tuxcare.3 of @angular/core. not_affected \u2014 Angular 15.2.9-tuxcare.1 is not affected by CVE-2026-54265. The vulnerability requires the new Ivy compiler 'pipeline' architecture with the TwoWayProperty IR operation, which was introduced in Angular 16+. Angular 15.2.9 uses the older compiler architecture where two-way bindings are desugared into separate property and event bindings, causing them to automatically receive the same sanitizatio..." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c5659d86-ad48-5e8e-99ac-80af4cb6c474", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.9-tuxcare.3 of @angular/core. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature does not exist in this version - it was introduced in Angular v16+. Without this feature, there is no code that hashes HTTP request properties for cache key generation, so the hash collision vulnerability cannot manifest." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:638cbc16-955f-5b14-88cb-4131ff21cc0b", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 15.2.9-tuxcare.3 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d3d18968-ebeb-517d-9fe3-b6211c2c3766", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.2.9-tuxcare.3 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0979a983-316e-5553-8cb1-ceb88db5b4d2", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 15.2.9-tuxcare.3 of @angular/core. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-68945. The vulnerability exists in the HttpTransferCache feature used during Server-Side Rendering (SSR), which generates cache keys from HTTP request parameters. However, this feature was not introduced until Angular 16.0.0. Angular 15.2.9 lacks the entire HttpTransferCache implementation: no transfer_cache.ts file exists, no HttpTransferCache class, ..." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d037b674-7763-57ac-9935-2602b9073f8d", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 15.2.9-tuxcare.3 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d9a30e75-f9bb-5bdf-b2aa-5958ee1c1283", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 15.2.9-tuxcare.3 of @angular/core." }, "affects": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/core@15.2.9-tuxcare.3" } ] }