{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f0b9bde7-a306-5222-ac85-226e91b28b2a", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/upgrade@15.2.6", "type": "library", "name": "@angular/upgrade", "version": "15.2.6", "purl": "pkg:npm/%40angular/upgrade@15.2.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:a6f70559-3157-53d3-a134-5fb2dc634754", "id": "CVE-2025-66412", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 15.2.6 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.6" } ] }, { "bom-ref": "urn:uuid:f975fc12-ba3d-5012-bb00-4622f1e5fe69", "id": "CVE-2026-22610", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 15.2.6 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.6" } ] }, { "bom-ref": "urn:uuid:d74c572a-07b4-5969-92bd-87146b46fb79", "id": "CVE-2026-27970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 15.2.6 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.6" } ] }, { "bom-ref": "urn:uuid:dae24948-6174-5be0-a03c-ca35349b355d", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.6 of @angular/upgrade. not_affected \u2014 Target version 15.2.6 is NOT affected by CVE-2026-41423. The target uses Node.js legacy url.parse() API which does NOT interpret protocol-relative URLs (//evil.com) as hostname overrides. The vulnerability only exists when using the WHATWG URL API (new URL()) without input preprocessing, which this version does not use. Testing confirms url.parse('//attacker.com') sets hostname to null (not 'at..." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.6" } ] }, { "bom-ref": "urn:uuid:afd513e6-7c09-58d3-b4eb-732d058e5dff", "id": "CVE-2026-46417", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 15.2.6 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.6" } ] }, { "bom-ref": "urn:uuid:6128995e-48ea-56a6-8f60-7b16280366e0", "id": "CVE-2026-50168", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50168 does not affect version 15.2.6 of @angular/upgrade. not_affected \u2014 CVE-2026-50168 targets a vulnerability in Angular's platform-server allowedHosts validation feature that allows bypassing hostname restrictions via malformed URLs (e.g., evil.com:80:80). The target repository (Angular v15.2.6-tuxcare.1) does not contain the allowedHosts feature (validateAllowedHosts, isHostAllowed functions) that this CVE exploits. Without the allowedHosts validation mechanism,..." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.6" } ] }, { "bom-ref": "urn:uuid:249850ef-de90-5171-8eee-ddfa65c3f980", "id": "CVE-2026-50169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 15.2.6 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.6" } ] }, { "bom-ref": "urn:uuid:feba616e-ea32-520c-9c3e-062fce583f09", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.6 of @angular/upgrade. not_affected \u2014 Angular version 15.2.6-tuxcare.1 does not contain the HttpTransferCache feature that is the subject of CVE-2026-50170. The vulnerable component (packages/common/http/src/transfer_cache.ts) was introduced in Angular v16.0.0-next.7, after the target version. The vulnerability requires automatic HTTP response caching in TransferState during SSR, which does not exist in v15.2.6." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.6" } ] }, { "bom-ref": "urn:uuid:f60baff9-0263-5e12-b3a9-29afe0c1dab3", "id": "CVE-2026-50171", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 15.2.6 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.6" } ] }, { "bom-ref": "urn:uuid:7c223832-172a-591d-b2fb-c8267fba4146", "id": "CVE-2026-50184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 15.2.6 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.6" } ] }, { "bom-ref": "urn:uuid:7011537c-c171-5ea7-8d4b-4d8235c8053f", "id": "CVE-2026-50555", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 15.2.6 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.6" } ] }, { "bom-ref": "urn:uuid:cf75ef62-581f-5455-b8c5-748bea461786", "id": "CVE-2026-50556", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 15.2.6 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.6" } ] }, { "bom-ref": "urn:uuid:9e248646-6776-5c19-8154-65b084b1274c", "id": "CVE-2026-50557", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 15.2.6 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.6" } ] }, { "bom-ref": "urn:uuid:d5fc5435-5301-5354-b970-29ac4d8feafd", "id": "CVE-2026-52725", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 15.2.6 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.6" } ] }, { "bom-ref": "urn:uuid:67b5a6d0-9358-5779-a8ca-6f3584edee0a", "id": "CVE-2026-54264", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 15.2.6 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.6" } ] }, { "bom-ref": "urn:uuid:ed5d20da-f950-5968-9848-64c3f7398394", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.2.6 of @angular/upgrade. not_affected \u2014 Angular 15.2.6 is not affected by CVE-2026-54265. The vulnerability is specific to the template pipeline architecture introduced in Angular 20+, which does not exist in Angular 15. Angular 15 uses the older render3 compiler that desugars two-way bindings into standard property bindings at parse time, and these property bindings correctly receive sanitizers." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.6" } ] }, { "bom-ref": "urn:uuid:0457dcbe-cdbd-5559-b807-cc946a1bcae7", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.6 of @angular/upgrade. not_affected \u2014 Angular 15.2.6-tuxcare.1 is not affected by CVE-2026-54266 because the HttpTransferCache feature, including the vulnerable weak DJB2 hash function, was not introduced until Angular v16.0.0. The target version predates the introduction of this feature entirely." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.6" } ] }, { "bom-ref": "urn:uuid:d36e37fd-c794-59ec-8628-a65318593fb9", "id": "CVE-2026-54267", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 15.2.6 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.6" } ] }, { "bom-ref": "urn:uuid:f1687669-b8af-56cd-819b-7d26a6308cd7", "id": "CVE-2026-54268", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 15.2.6 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.6" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.6" } ] }