{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4d955319-77f0-5ddb-a7c5-6ca90f7a40d0", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/language-service@15.2.1-tuxcare.3", "type": "library", "name": "@angular/language-service", "version": "15.2.1-tuxcare.3", "purl": "pkg:npm/%40angular/language-service@15.2.1-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:9a003fe6-9e48-5e88-b191-cfdcded0fb66", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.2.1-tuxcare.3 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0c6e81b1-b775-57ac-865c-7bcc85718d21", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 15.2.1-tuxcare.3 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4ae41c55-9087-5518-bd71-fce7bfcfaf55", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 15.2.1-tuxcare.3 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e33ff250-5287-560e-87ba-db079f1bf417", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 15.2.1-tuxcare.3 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:060a2ec9-43c0-54a7-8653-739188ce2b77", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.1-tuxcare.3 of @angular/language-service. not_affected \u2014 The target Angular version 15.2.1 uses Node.js url.parse() API which does not exhibit the protocol-relative URL hostname override vulnerability. The vulnerable behavior was introduced in Angular 17+ when the code was refactored to use WHATWG new URL() API. Version 15.2.1 is not affected by CVE-2026-41423." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:757b7e35-3a80-5e75-b098-7fb7ece4bb2d", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.2.1-tuxcare.3 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:370a7a7a-baaf-5444-9c51-54f94ce5549e", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 15.2.1-tuxcare.3 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:906b282a-aa8f-52bc-a497-5ea8726f4431", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 15.2.1-tuxcare.3 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:45df11e1-7f45-54b1-b7ba-d4f4a31dbec0", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.1-tuxcare.3 of @angular/language-service. not_affected \u2014 Angular 15.2.1 is not affected by CVE-2026-50170. The HTTP transfer cache feature that contains the vulnerability was introduced in Angular v16+ and does not exist in version 15.2.1. The target repository lacks the entire affected component (packages/common/http/src/transfer_cache.ts) and all related transfer cache functionality." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3dd0acd7-52a0-58a6-b39f-e049bbb1cc09", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.2.1-tuxcare.3 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7586ae97-1d37-535e-a0cc-137d33f0692e", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 15.2.1-tuxcare.3 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d2a32447-1c62-54c7-8514-4d7de849c34a", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.2.1-tuxcare.3 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f9a3fc99-8264-5a6c-bdf6-9b7b926e71f9", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.2.1-tuxcare.3 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:338baac3-80a7-56e7-989b-3ac0bfcae4ce", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 15.2.1-tuxcare.3 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fb1f8c67-759f-5721-b8fb-03ffc2318200", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 15.2.1-tuxcare.3 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9c8a1cc5-5507-5312-adb6-5015d4b7a4d5", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 15.2.1-tuxcare.3 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d461ede6-13b2-5265-96e7-53e0bfcf051c", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.2.1-tuxcare.3 of @angular/language-service. not_affected \u2014 Angular 15.2.1-tuxcare.1 is NOT AFFECTED by CVE-2026-54265. The vulnerability exists only in Angular 16+ where the template pipeline architecture introduced a TwoWayProperty operation kind that was missing from the sanitizer resolution switch. Angular 15.2.1 uses the pre-pipeline Ivy compiler where two-way bindings desugar through the same parsePropertyBinding() as one-way bindings, inheriting ..." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9d99da25-7cda-5845-931e-12aced7dbbe9", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.1-tuxcare.3 of @angular/language-service. not_affected \u2014 Angular 15.2.1 does not contain the HttpTransferCache feature, which was introduced in Angular 16.0.0. The vulnerable code path involving hash-based HTTP request caching does not exist in this version." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9fd14ac9-20c3-50af-8757-4d10aed5c94c", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 15.2.1-tuxcare.3 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5c36c704-b03a-550c-8eda-1384680b6c42", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.2.1-tuxcare.3 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f5515da8-2628-5a24-aa23-a66b65cdfaac", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 15.2.1-tuxcare.3 of @angular/language-service. not_affected \u2014 Angular 15.2.1 does not contain the HttpTransferCache feature that is vulnerable in CVE-2026-68945. The HttpTransferCache functionality, which caches HTTP requests during Server-Side Rendering (SSR) and generates cache keys from request parameters, was introduced in Angular 16.0.0 (released March 31, 2023). The target version 15.2.1 predates this feature introduction by approximately 2 months. ..." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:55f6cf0c-c0fc-50e0-aaf2-298761a7478f", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 15.2.1-tuxcare.3 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:772d9659-c1c5-55a6-b1b1-0662e4516d78", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 15.2.1-tuxcare.3 of @angular/language-service." }, "affects": [ { "ref": "pkg:npm/%40angular/language-service@15.2.1-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/language-service@15.2.1-tuxcare.3" } ] }