{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b11224aa-da02-560c-9d22-40f12c20a243", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/platform-browser@15.2.9-tuxcare.3", "type": "library", "name": "@angular/platform-browser", "version": "15.2.9-tuxcare.3", "purl": "pkg:npm/%40angular/platform-browser@15.2.9-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:d00c0f33-c389-5f2a-81fc-e0cb75ab3e5e", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.2.9-tuxcare.3 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:07d80ee5-cf26-54e2-a585-137055a66c60", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 15.2.9-tuxcare.3 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d3a13be9-abc4-5e9b-949e-cfd61d519d95", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 15.2.9-tuxcare.3 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:02bea3ec-92f7-544a-aca6-d44ae2b0967a", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 15.2.9-tuxcare.3 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:884dddb3-1c17-5226-9918-c9825526e7dd", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.9-tuxcare.3 of @angular/platform-browser. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-41423. The SSRF vulnerability via protocol-relative URLs was introduced in Angular 17.0.0 when the codebase switched from Node.js url.parse to WHATWG URL API. Angular 15.2.9 still uses the legacy Node.js url.parse which treats protocol-relative URLs ('//evil.com') as pathnames, not hostname overrides, preventing the SSRF attack vector." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:55201e2f-f3ea-5f59-bf86-5aec8978df06", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.2.9-tuxcare.3 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1da98dcf-eaac-529c-aacf-8923dcd524e3", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 15.2.9-tuxcare.3 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e29d7a08-cd55-597c-8944-9d5bac31571b", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 15.2.9-tuxcare.3 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:53b5bdb1-b214-5239-a086-67644a8c9fce", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.9-tuxcare.3 of @angular/platform-browser. not_affected \u2014 no evidence captured" }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:26288bfc-b423-5ab7-ba13-15aee69e6b72", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.2.9-tuxcare.3 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:26f5a751-1b90-5f7b-9b96-1b51d4114808", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 15.2.9-tuxcare.3 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b8e6cc3f-ade1-51d3-a6fe-c3de765892d4", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.2.9-tuxcare.3 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4ad9e2e6-578f-5a33-b3e3-c2511b3a250b", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.2.9-tuxcare.3 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0993fdc4-12c8-5488-8eda-822d10221248", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 15.2.9-tuxcare.3 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:350564ce-4ea3-5e3f-880c-4dac4a04912a", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 15.2.9-tuxcare.3 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:96aee0b4-7049-5937-b752-e2e7701ec349", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 15.2.9-tuxcare.3 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0b65c508-6f2e-50bd-8305-89a108b55251", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.2.9-tuxcare.3 of @angular/platform-browser. not_affected \u2014 Angular 15.2.9-tuxcare.1 is not affected by CVE-2026-54265. The vulnerability requires the new Ivy compiler 'pipeline' architecture with the TwoWayProperty IR operation, which was introduced in Angular 16+. Angular 15.2.9 uses the older compiler architecture where two-way bindings are desugared into separate property and event bindings, causing them to automatically receive the same sanitizatio..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:07ed7953-f8be-5d26-852c-823281e58c62", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.9-tuxcare.3 of @angular/platform-browser. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature does not exist in this version - it was introduced in Angular v16+. Without this feature, there is no code that hashes HTTP request properties for cache key generation, so the hash collision vulnerability cannot manifest." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1a363176-0efb-5333-b19b-338f21c09a81", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 15.2.9-tuxcare.3 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7d78b713-ebc1-5753-9d5f-5c79038807c4", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.2.9-tuxcare.3 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cf95f9ca-acf0-53bb-b251-3f397952c160", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 15.2.9-tuxcare.3 of @angular/platform-browser. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-68945. The vulnerability exists in the HttpTransferCache feature used during Server-Side Rendering (SSR), which generates cache keys from HTTP request parameters. However, this feature was not introduced until Angular 16.0.0. Angular 15.2.9 lacks the entire HttpTransferCache implementation: no transfer_cache.ts file exists, no HttpTransferCache class, ..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:070faaba-c93d-5c51-a2d4-b03d27950776", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 15.2.9-tuxcare.3 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.2.9-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e6222ca5-87a7-578f-816b-9ae43d21b22e", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 15.2.9-tuxcare.3 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.2.9-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser@15.2.9-tuxcare.3" } ] }