{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a1f2f595-6cc3-52ee-a96f-4de7d9dc10e0", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/platform-server@15.2.9", "type": "library", "name": "@angular/platform-server", "version": "15.2.9", "purl": "pkg:npm/%40angular/platform-server@15.2.9" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:a131af25-bf69-50d0-bef9-ae5022748fbf", "id": "CVE-2025-66412", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 15.2.9 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9" } ] }, { "bom-ref": "urn:uuid:82437e00-7101-5bf8-9f32-72acefcf9ad2", "id": "CVE-2026-22610", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 15.2.9 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9" } ] }, { "bom-ref": "urn:uuid:4d985122-f960-51e5-97d3-5d2271f4d243", "id": "CVE-2026-27970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 15.2.9 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9" } ] }, { "bom-ref": "urn:uuid:d7c38a69-6a57-54e2-8e3e-f6ce822e98eb", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.9 of @angular/platform-server. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-41423. The SSRF vulnerability via protocol-relative URLs was introduced in Angular 17.0.0 when the codebase switched from Node.js url.parse to WHATWG URL API. Angular 15.2.9 still uses the legacy Node.js url.parse which treats protocol-relative URLs ('//evil.com') as pathnames, not hostname overrides, preventing the SSRF attack vector." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9" } ] }, { "bom-ref": "urn:uuid:2fe96562-02b9-501e-a273-54ba574032e8", "id": "CVE-2026-46417", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 15.2.9 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9" } ] }, { "bom-ref": "urn:uuid:1235f8d7-f71e-528b-865b-89610308a324", "id": "CVE-2026-50168", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 15.2.9 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9" } ] }, { "bom-ref": "urn:uuid:88831bb6-e007-51ad-9ba3-e496379a98b8", "id": "CVE-2026-50169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 15.2.9 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9" } ] }, { "bom-ref": "urn:uuid:525e682e-4b40-5783-8817-862980ee52ce", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.9 of @angular/platform-server. not_affected \u2014 no evidence captured" }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9" } ] }, { "bom-ref": "urn:uuid:c9fd901e-3f42-59dc-9fee-a0f34157b5e4", "id": "CVE-2026-50171", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 15.2.9 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9" } ] }, { "bom-ref": "urn:uuid:806c81db-4642-52c4-bdc8-0815ba38d01c", "id": "CVE-2026-50184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 15.2.9 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9" } ] }, { "bom-ref": "urn:uuid:36eb311b-4155-5727-910b-dc18a9170113", "id": "CVE-2026-50555", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 15.2.9 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9" } ] }, { "bom-ref": "urn:uuid:c1dc0203-9390-5964-8f49-ddabfdd3b63d", "id": "CVE-2026-50556", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 15.2.9 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9" } ] }, { "bom-ref": "urn:uuid:266ee784-8079-55d5-ae4c-bf7bbe15b095", "id": "CVE-2026-50557", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 15.2.9 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9" } ] }, { "bom-ref": "urn:uuid:63d4541e-23db-5e81-bc79-86c6155dc575", "id": "CVE-2026-52725", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 15.2.9 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9" } ] }, { "bom-ref": "urn:uuid:a80995ae-ff39-5a9f-994b-ad33b1007079", "id": "CVE-2026-54264", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 15.2.9 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9" } ] }, { "bom-ref": "urn:uuid:dc33bdd6-8fee-5107-a9bb-6e3c764ea2c7", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.2.9 of @angular/platform-server. not_affected \u2014 Angular 15.2.9-tuxcare.1 is not affected by CVE-2026-54265. The vulnerability requires the new Ivy compiler 'pipeline' architecture with the TwoWayProperty IR operation, which was introduced in Angular 16+. Angular 15.2.9 uses the older compiler architecture where two-way bindings are desugared into separate property and event bindings, causing them to automatically receive the same sanitizatio..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9" } ] }, { "bom-ref": "urn:uuid:8143c38f-e19e-564d-a067-5cebe95a84ad", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.9 of @angular/platform-server. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature does not exist in this version - it was introduced in Angular v16+. Without this feature, there is no code that hashes HTTP request properties for cache key generation, so the hash collision vulnerability cannot manifest." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9" } ] }, { "bom-ref": "urn:uuid:2a5f5623-c6c4-5817-a504-cc52321a785a", "id": "CVE-2026-54267", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 15.2.9 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9" } ] }, { "bom-ref": "urn:uuid:b37005e7-4a9f-57ec-b2df-1fc7c35fefbc", "id": "CVE-2026-54268", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 15.2.9 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.9" } ] }