{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1e2f7d06-0a92-57db-b4e3-294ba2f202c3", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.3", "type": "library", "name": "@angular/elements", "version": "15.2.9-tuxcare.3", "purl": "pkg:npm/%40angular/elements@15.2.9-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:50cb93bc-2347-57b1-ac56-df6a700a7107", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.2.9-tuxcare.3 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:83e17d01-97a6-5d36-a42d-15ea6ee8d3de", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 15.2.9-tuxcare.3 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2a538915-ebd3-55ea-8de3-23bfab980d5a", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 15.2.9-tuxcare.3 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d406374e-0d1e-51c0-bc51-857e5dd50013", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 15.2.9-tuxcare.3 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3c56793b-a533-5bd1-a4a6-5310e6acbb94", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.9-tuxcare.3 of @angular/elements. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-41423. The SSRF vulnerability via protocol-relative URLs was introduced in Angular 17.0.0 when the codebase switched from Node.js url.parse to WHATWG URL API. Angular 15.2.9 still uses the legacy Node.js url.parse which treats protocol-relative URLs ('//evil.com') as pathnames, not hostname overrides, preventing the SSRF attack vector." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:137c25b0-b698-5da4-99a2-ac2ed23de38b", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.2.9-tuxcare.3 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8b1c271c-5bee-56f2-9f7d-bfa6c29ad070", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 15.2.9-tuxcare.3 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8db1ae61-8842-5f21-822b-4e6dd5648d36", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 15.2.9-tuxcare.3 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1e072acf-3fce-5973-80a0-b94b2ff04640", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.9-tuxcare.3 of @angular/elements. not_affected \u2014 no evidence captured" }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c8f1ac65-7e28-560e-95ad-6b777fa1813d", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.2.9-tuxcare.3 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9f9505c0-b3fe-52fc-abf7-0a80a2ea2be5", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 15.2.9-tuxcare.3 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:da5a725c-5f7d-5aae-8d86-0a528181a70f", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.2.9-tuxcare.3 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:86d90175-61f3-558d-b62e-b524a862153a", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.2.9-tuxcare.3 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d66746a3-6eec-5344-9db2-9d656d500e33", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 15.2.9-tuxcare.3 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ddaaae4e-bc7c-5bad-83b3-f8548eb1d477", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 15.2.9-tuxcare.3 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f24c94aa-2230-5628-bb03-7aa628538733", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 15.2.9-tuxcare.3 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:816bfa39-2e17-583f-b288-5c701592eb99", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.2.9-tuxcare.3 of @angular/elements. not_affected \u2014 Angular 15.2.9-tuxcare.1 is not affected by CVE-2026-54265. The vulnerability requires the new Ivy compiler 'pipeline' architecture with the TwoWayProperty IR operation, which was introduced in Angular 16+. Angular 15.2.9 uses the older compiler architecture where two-way bindings are desugared into separate property and event bindings, causing them to automatically receive the same sanitizatio..." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:60034c31-0661-59d3-9791-f4b42084f2c0", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.9-tuxcare.3 of @angular/elements. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature does not exist in this version - it was introduced in Angular v16+. Without this feature, there is no code that hashes HTTP request properties for cache key generation, so the hash collision vulnerability cannot manifest." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:68251c21-8dda-50ec-aec8-51de7dab6726", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 15.2.9-tuxcare.3 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3fc02c2f-2231-56fc-94b7-cbd1bc9e77ac", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.2.9-tuxcare.3 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b9fc5b11-9eb2-5fa4-b009-f256f0311100", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 15.2.9-tuxcare.3 of @angular/elements. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-68945. The vulnerability exists in the HttpTransferCache feature used during Server-Side Rendering (SSR), which generates cache keys from HTTP request parameters. However, this feature was not introduced until Angular 16.0.0. Angular 15.2.9 lacks the entire HttpTransferCache implementation: no transfer_cache.ts file exists, no HttpTransferCache class, ..." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8acf8abb-6d1d-5292-ad91-8a8e78a7469a", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 15.2.9-tuxcare.3 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:873bdd79-b5f2-5109-b530-69674f473bbf", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 15.2.9-tuxcare.3 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.3" } ] }