{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:19ad7399-68d6-5de9-a460-c61225ef966e", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.1", "type": "library", "name": "@angular/platform-browser-dynamic", "version": "7.2.11-tuxcare.1", "purl": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:b0be8066-ae9e-5b15-b086-acdaef5a47df", "id": "CVE-2021-4231", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-4231 affects version 7.2.11-tuxcare.1 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4d43ad0c-936e-5be2-80c8-596ef04f49f2", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 7.2.11-tuxcare.1 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:24c32931-b39d-527c-b09c-53f72ccf55d2", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 7.2.11-tuxcare.1 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:348041df-0e05-57b7-8b31-ae7e4996afae", "id": "CVE-2026-22610", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 7.2.11-tuxcare.1 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a24ead31-93b6-587d-876b-f51cdea0a3a4", "id": "CVE-2026-27970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 7.2.11-tuxcare.1 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0498ad84-ddfb-532d-af52-51497e9d2510", "id": "CVE-2026-41423", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41423 affects version 7.2.11-tuxcare.1 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ce4a5dbf-71ca-5ac7-a538-3710b40e9075", "id": "CVE-2026-46417", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 7.2.11-tuxcare.1 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3e3691d5-2adf-51f6-8552-8797940c4c76", "id": "CVE-2026-50168", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50168 does not affect version 7.2.11-tuxcare.1 of @angular/platform-browser-dynamic. not_affected \u2014 CVE-2026-50168 addresses vulnerabilities in the WHATWG URL-based parseUrl implementation and allowedHosts validation feature introduced in Angular's CVE-2026-41423 fix. The target (v7.2.11) uses a completely different architecture with Node.js legacy url.parse() and does not have the allowedHosts feature. The specific vulnerable code patterns that CVE-2026-50168 patches do not exist in this ver..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3343b0e3-7073-5e5f-b142-9ea65d095a95", "id": "CVE-2026-50169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 7.2.11-tuxcare.1 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:37e06f24-7663-5036-9ae5-e80af79060be", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 7.2.11-tuxcare.1 of @angular/platform-browser-dynamic. not_affected \u2014 Angular v7.2.11 is not affected by CVE-2026-50170. The HTTP Transfer Cache feature that is vulnerable does not exist in this version. The feature was introduced in Angular v16+, and v7.2.11 lacks the transfer_cache.ts module, withHttpTransferCache provider, and provideClientHydration functionality entirely." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3af0d2f5-5c0e-5e0a-a2b2-ca161795df2c", "id": "CVE-2026-50171", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 7.2.11-tuxcare.1 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e1d5e074-60ee-5c4e-838c-d61771e682fd", "id": "CVE-2026-50184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 7.2.11-tuxcare.1 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7c016a09-427d-59b7-b607-8cf482b061be", "id": "CVE-2026-50555", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 7.2.11-tuxcare.1 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:24b4de6c-f677-5244-af5c-eba1079c12a3", "id": "CVE-2026-50556", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 7.2.11-tuxcare.1 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b04f0454-d139-5a83-922c-97846339977c", "id": "CVE-2026-50557", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 7.2.11-tuxcare.1 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cab5769c-8c44-5abc-b2e5-32b7f9e6bda6", "id": "CVE-2026-52725", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 7.2.11-tuxcare.1 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:90425865-046f-5ad2-8958-4acec9117878", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 7.2.11-tuxcare.1 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 7.2.11-tuxcare.2 is not affected by CVE-2026-54264. The vulnerability concerns sensitive header leakage on cross-origin redirects in the request metadata preservation feature. This version predates that feature entirely - it strips ALL request headers when making network requests for assets, as evidenced by code comments and the absence of the newRequestWithMetadata method introduced in..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:84366b60-1cfc-5a14-8c41-b89ae832bb10", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 7.2.11-tuxcare.1 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 7.2.11-tuxcare.2 uses View Engine compiler architecture, not Ivy. The vulnerability (CVE-2026-54265) is specific to Ivy's template compiler pipeline where TwoWayProperty operations were missing from the sanitizer resolution switch. View Engine does not have TwoWayProperty operations; two-way bindings desugar early in the template parser to the same parsePropertyBinding() code path as on..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4bb4c2a3-8d54-515f-a9b4-ad6037d0e977", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 7.2.11-tuxcare.1 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 7.2.11-tuxcare.2 is not affected by CVE-2026-54266. The HttpTransferCache feature that contains the weak hash vulnerability does not exist in this version - it was introduced in Angular 16." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ccc781fd-19e3-5566-9e89-14d02c5ade1b", "id": "CVE-2026-54267", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 7.2.11-tuxcare.1 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e7bc5179-5262-54df-937b-8c69d99e7bf8", "id": "CVE-2026-54268", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 7.2.11-tuxcare.1 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@7.2.11-tuxcare.1" } ] }