{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f5f88f20-fc2f-5604-83da-c73af3d59fbc", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/http@5.1.2-tuxcare.4", "type": "library", "name": "@angular/http", "version": "5.1.2-tuxcare.4", "purl": "pkg:npm/%40angular/http@5.1.2-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:e9e89b80-9c1f-5d37-93e8-8d7c61fec1b4", "id": "CVE-2021-4231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.1.2-tuxcare.4 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9d4cd54e-a40a-5640-b4b2-3a14809d0834", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.1.2-tuxcare.4 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9bc09c4e-f29c-5c08-982f-49014727dc8c", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.1.2-tuxcare.4 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9ecfe216-815d-548e-b464-3a35b7584974", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.1.2-tuxcare.4 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7b3a0b67-2644-5d19-95e6-34586806f05f", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.1.2-tuxcare.4 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:25d6bb76-8d0a-59fb-841a-3d70ddfa020f", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 5.1.2-tuxcare.4 of @angular/http. not_affected \u2014 Angular version 5.1.2 is not affected by CVE-2026-41423. The vulnerability requires the WHATWG URL API which exhibits hostname override behavior with protocol-relative URLs. The target uses Node.js's legacy url.parse() API which does not have this behavior." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:03ddcb04-e1d1-53c8-a8b4-62c47b44a890", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.1.2-tuxcare.4 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a9611fcf-2b26-5e7b-b923-ab1474e9dd5c", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.1.2-tuxcare.4 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:bf59a138-f204-54ed-8c92-cb28465e75f1", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.1.2-tuxcare.4 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5dbde09a-548b-5e5f-aae9-9d095f5bef6a", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 5.1.2-tuxcare.4 of @angular/http. not_affected \u2014 no evidence captured" }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4ea2e258-f303-5739-897c-6dd80e20a9d2", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.1.2-tuxcare.4 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:cf76c209-913d-54b7-b1de-b2b9f6947d60", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.1.2-tuxcare.4 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:bd5c02aa-b868-59cd-b4fa-5bc5fae5e149", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.1.2-tuxcare.4 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:192c4449-464a-5779-8fba-e38e29ab62e6", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.1.2-tuxcare.4 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a27c7b92-d37b-5383-93c8-ef2281981bbb", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.1.2-tuxcare.4 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b2f0927a-a3e1-5cc2-8aea-f62af6002a16", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.1.2-tuxcare.4 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6d8fefb0-ca38-57ee-b836-f008f0cd4828", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 5.1.2-tuxcare.4 of @angular/http. not_affected \u2014 Angular v5.1.2-tuxcare.1 is NOT affected by CVE-2026-54264. The vulnerability requires a `newRequestWithMetadata` function that copies request headers, which does not exist in this version. The service worker reconstructs asset requests from URLs only using bare `adapter.newRequest(url)` calls, never copying or forwarding request headers. Therefore, credential headers cannot be leaked on cross-..." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6a8c88d5-4493-5980-8f1b-e0c258065d90", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 5.1.2-tuxcare.4 of @angular/http. not_affected \u2014 Angular 5.1.2 uses the View Engine compiler architecture, which does not have the TwoWayProperty operation kind that is vulnerable in the Ivy compiler. In View Engine, two-way bindings desugar through the same parsePropertyBinding() code path as one-way bindings, ensuring both receive identical security context resolution and sanitization. The vulnerability pattern described in CVE-2026-54265 c..." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e6fdb93c-bf8f-5690-97c7-4f8f6daf0b64", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 5.1.2-tuxcare.4 of @angular/http. not_affected \u2014 Angular 5.1.2 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature that generates cache keys using a weak 32-bit DJB2 hash does not exist in this version. This feature was introduced in Angular v16+, while the target is v5.1.2. Although TransferState exists in this version for basic state transfer, there is no integration with HttpClient for automatic response caching, no..." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d507e68a-6bb3-5001-80b5-05da22b2561f", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.1.2-tuxcare.4 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1d8cdf69-b95e-5ec5-b74b-c9a15bfdbbe4", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.1.2-tuxcare.4 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8187e238-10ee-57fa-b869-593d8ad72ab2", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.1.2-tuxcare.4 of @angular/http. not_affected \u2014 Angular 5.1.2 is not affected by CVE-2026-68945. The vulnerable component HttpTransferCache does not exist in this version. HttpTransferCache was introduced in Angular v16 (circa 2022), while this target is Angular 5.1.2 (2017-2018 era). Although Angular 5.1.2 has TransferState for basic SSR state transfer and HttpClient with HttpParams, it lacks the HTTP response caching mechanism during SSR t..." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1434effe-1259-556f-a574-242fb1ba5cca", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.1.2-tuxcare.4 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.1.2-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9418b39c-75a7-5553-8541-844b9ab87247", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 5.1.2-tuxcare.4 of @angular/http." }, "affects": [ { "ref": "pkg:npm/%40angular/http@5.1.2-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/http@5.1.2-tuxcare.4" } ] }