{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:83a19a97-caee-5c7e-b666-9bb4b434772d", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.2", "type": "library", "name": "@angular/platform-browser-dynamic", "version": "5.1.2-tuxcare.2", "purl": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:1dc3d999-4412-5bb6-938d-bcdd264a1935", "id": "CVE-2021-4231", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-4231 affects version 5.1.2-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ef14ad45-0982-5086-9432-feb00f5fff85", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.1.2-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f30f3372-3b46-53ac-819c-28168a75a56e", "id": "CVE-2025-66412", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 5.1.2-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6e59f1f7-452e-59a4-9737-4337a12cb36d", "id": "CVE-2026-22610", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 5.1.2-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3c102472-3d42-5870-95cb-89846e1fd60c", "id": "CVE-2026-27970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 5.1.2-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:83cfb06b-462d-5c00-9629-53a3c0bc3989", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 5.1.2-tuxcare.2 of @angular/platform-browser-dynamic. not_affected \u2014 Angular version 5.1.2 is not affected by CVE-2026-41423. The vulnerability requires the WHATWG URL API which exhibits hostname override behavior with protocol-relative URLs. The target uses Node.js's legacy url.parse() API which does not have this behavior." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:371a2d8c-9e8a-5757-9037-8d063fdcdf24", "id": "CVE-2026-46417", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 5.1.2-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cbe7d6ff-0d05-5983-82b3-0c2af8073eb8", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.1.2-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c4fb90dd-dfbf-5797-90d0-3c19ba6f1557", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.1.2-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c853d64a-aa7d-57f7-a3c6-f24c0d8728f6", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 5.1.2-tuxcare.2 of @angular/platform-browser-dynamic. not_affected \u2014 no evidence captured" }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:36704902-50ea-5227-bc89-8e9f8c11f96b", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.1.2-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e61f22c0-f057-5813-8cb2-5e68b74a1515", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.1.2-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:86a78d0a-9ded-5461-8802-5298433c46b4", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.1.2-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f197834e-5f32-577b-83e5-8c7eee8b77b0", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.1.2-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:692ea4d3-8a2b-5849-9873-5ee7bc097329", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.1.2-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:85083554-e830-5b3b-a7ed-941548a72717", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.1.2-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:dc0e8002-ccf4-5b3d-9dfc-5ad19e3ba1a7", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 5.1.2-tuxcare.2 of @angular/platform-browser-dynamic. not_affected \u2014 Angular v5.1.2-tuxcare.1 is NOT affected by CVE-2026-54264. The vulnerability requires a `newRequestWithMetadata` function that copies request headers, which does not exist in this version. The service worker reconstructs asset requests from URLs only using bare `adapter.newRequest(url)` calls, never copying or forwarding request headers. Therefore, credential headers cannot be leaked on cross-..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:97c774f1-5a24-59a1-a289-d09d1b7c83a1", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 5.1.2-tuxcare.2 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 5.1.2 uses the View Engine compiler architecture, which does not have the TwoWayProperty operation kind that is vulnerable in the Ivy compiler. In View Engine, two-way bindings desugar through the same parsePropertyBinding() code path as one-way bindings, ensuring both receive identical security context resolution and sanitization. The vulnerability pattern described in CVE-2026-54265 c..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3c66105b-e8da-5d18-9f6f-62663d3992df", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 5.1.2-tuxcare.2 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 5.1.2 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature that generates cache keys using a weak 32-bit DJB2 hash does not exist in this version. This feature was introduced in Angular v16+, while the target is v5.1.2. Although TransferState exists in this version for basic state transfer, there is no integration with HttpClient for automatic response caching, no..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d6f2a313-ae47-55ba-85b3-eca56a61aff1", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.1.2-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:67b82740-1c98-58f7-b852-01c94f10fd5d", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.1.2-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.2" } ] }