{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7b9fd344-8efa-51f4-a402-0a219d1761c9", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/upgrade@15.2.1-tuxcare.3", "type": "library", "name": "@angular/upgrade", "version": "15.2.1-tuxcare.3", "purl": "pkg:npm/%40angular/upgrade@15.2.1-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:00ccd358-f7eb-5943-a854-69a186aac398", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.2.1-tuxcare.3 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b22860e8-a309-5127-93d8-d8f4eeba2559", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 15.2.1-tuxcare.3 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:802659d1-7673-5df2-92f6-cb464c9d7103", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 15.2.1-tuxcare.3 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fe1437f5-65b4-5cdb-996f-7fdde1e9661c", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 15.2.1-tuxcare.3 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:560852ea-dc56-5169-8743-d81c4c8d60e9", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.1-tuxcare.3 of @angular/upgrade. not_affected \u2014 The target Angular version 15.2.1 uses Node.js url.parse() API which does not exhibit the protocol-relative URL hostname override vulnerability. The vulnerable behavior was introduced in Angular 17+ when the code was refactored to use WHATWG new URL() API. Version 15.2.1 is not affected by CVE-2026-41423." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:67b7cac8-08d7-53ca-bed0-69e4e8e5ab73", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.2.1-tuxcare.3 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:dc47b6cc-ba82-5a0b-b443-d07bd487032a", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 15.2.1-tuxcare.3 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2fe92762-0d95-5bff-8696-25e011a662f4", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 15.2.1-tuxcare.3 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e6c94a0b-3406-58c1-806b-efbeebb30e4e", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.1-tuxcare.3 of @angular/upgrade. not_affected \u2014 Angular 15.2.1 is not affected by CVE-2026-50170. The HTTP transfer cache feature that contains the vulnerability was introduced in Angular v16+ and does not exist in version 15.2.1. The target repository lacks the entire affected component (packages/common/http/src/transfer_cache.ts) and all related transfer cache functionality." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0242c693-8bcc-59cc-8cf9-b1aa2eab31d4", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.2.1-tuxcare.3 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8edeffbc-ef96-52b2-b418-b39333a62575", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 15.2.1-tuxcare.3 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e34c6569-45f8-5b8b-88de-10d70e64321b", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.2.1-tuxcare.3 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7d3cf84a-3731-585c-a761-41bb977cb0da", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.2.1-tuxcare.3 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:46d2bcd9-4d87-5d4a-9820-ebe65857fd45", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 15.2.1-tuxcare.3 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4e0edd70-b9c7-5825-bc14-742fea4c88e1", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 15.2.1-tuxcare.3 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4096a542-5a50-5a35-88ec-4b70eddcd79f", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 15.2.1-tuxcare.3 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5ce2f907-5c23-5069-9c23-c885536885a6", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.2.1-tuxcare.3 of @angular/upgrade. not_affected \u2014 Angular 15.2.1-tuxcare.1 is NOT AFFECTED by CVE-2026-54265. The vulnerability exists only in Angular 16+ where the template pipeline architecture introduced a TwoWayProperty operation kind that was missing from the sanitizer resolution switch. Angular 15.2.1 uses the pre-pipeline Ivy compiler where two-way bindings desugar through the same parsePropertyBinding() as one-way bindings, inheriting ..." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1dfc8e3b-49d6-507a-960b-3320c70c11ff", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.1-tuxcare.3 of @angular/upgrade. not_affected \u2014 Angular 15.2.1 does not contain the HttpTransferCache feature, which was introduced in Angular 16.0.0. The vulnerable code path involving hash-based HTTP request caching does not exist in this version." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f096ada1-07c0-5761-a524-19043808f9bc", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 15.2.1-tuxcare.3 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e65133df-0f7c-5c02-8505-c83c76b194ae", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.2.1-tuxcare.3 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9eeeae48-8011-5d30-b94a-8aa652c256a5", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 15.2.1-tuxcare.3 of @angular/upgrade. not_affected \u2014 Angular 15.2.1 does not contain the HttpTransferCache feature that is vulnerable in CVE-2026-68945. The HttpTransferCache functionality, which caches HTTP requests during Server-Side Rendering (SSR) and generates cache keys from request parameters, was introduced in Angular 16.0.0 (released March 31, 2023). The target version 15.2.1 predates this feature introduction by approximately 2 months. ..." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6bd9bead-6cad-51ab-bf1d-a1f392fbd749", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 15.2.1-tuxcare.3 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.1-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9b720cf4-114d-5bc4-bb00-e89df3392ca8", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 15.2.1-tuxcare.3 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.1-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.1-tuxcare.3" } ] }