{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:584d21be-801c-5e08-a764-63a843305842", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/upgrade@15.2.9-tuxcare.1", "type": "library", "name": "@angular/upgrade", "version": "15.2.9-tuxcare.1", "purl": "pkg:npm/%40angular/upgrade@15.2.9-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:05537c6a-7e15-5ad7-8ddb-eeaeb008cf01", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.2.9-tuxcare.1 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e65fe0bc-b57e-5617-8f86-d254412a9212", "id": "CVE-2025-66412", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 15.2.9-tuxcare.1 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0b17584b-4e36-5fcd-8146-509f91739f35", "id": "CVE-2026-22610", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 15.2.9-tuxcare.1 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2e80b854-b278-5ee6-889b-dd519e066c49", "id": "CVE-2026-27970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 15.2.9-tuxcare.1 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:16ce8b9e-9640-5fb2-b29c-6b8297ee3932", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.9-tuxcare.1 of @angular/upgrade. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-41423. The SSRF vulnerability via protocol-relative URLs was introduced in Angular 17.0.0 when the codebase switched from Node.js url.parse to WHATWG URL API. Angular 15.2.9 still uses the legacy Node.js url.parse which treats protocol-relative URLs ('//evil.com') as pathnames, not hostname overrides, preventing the SSRF attack vector." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:91976e59-3a7d-550e-9385-66cb18776512", "id": "CVE-2026-46417", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 15.2.9-tuxcare.1 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3559fa4f-7370-5ca7-860e-72fd810b7d6b", "id": "CVE-2026-50168", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 15.2.9-tuxcare.1 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f0f99a82-58ec-5d99-a502-6e41d491f5e9", "id": "CVE-2026-50169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 15.2.9-tuxcare.1 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9f090749-2a10-5d2f-89ae-7802fa96292e", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.9-tuxcare.1 of @angular/upgrade. not_affected \u2014 no evidence captured" }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cc63926e-0ec2-52a4-a26e-b8f840427072", "id": "CVE-2026-50171", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 15.2.9-tuxcare.1 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9e0f72ea-4541-55f9-bffc-12ace8761424", "id": "CVE-2026-50184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 15.2.9-tuxcare.1 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1e48a01a-185d-5827-b6ad-afb1be0f92d2", "id": "CVE-2026-50555", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 15.2.9-tuxcare.1 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d8ffba65-e355-59e0-8a11-6de5803f85d3", "id": "CVE-2026-50556", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 15.2.9-tuxcare.1 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c6b538ab-5a93-5045-8eed-0bec5ecfaf7f", "id": "CVE-2026-50557", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 15.2.9-tuxcare.1 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:96b7953a-130e-5df0-b8e1-610d8807a3a6", "id": "CVE-2026-52725", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 15.2.9-tuxcare.1 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b36b5b6a-b5be-5b32-9acc-3f596dd2ffa1", "id": "CVE-2026-54264", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 15.2.9-tuxcare.1 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e794c104-ab04-5e0d-82b4-763c8e3289da", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.2.9-tuxcare.1 of @angular/upgrade. not_affected \u2014 Angular 15.2.9-tuxcare.1 is not affected by CVE-2026-54265. The vulnerability requires the new Ivy compiler 'pipeline' architecture with the TwoWayProperty IR operation, which was introduced in Angular 16+. Angular 15.2.9 uses the older compiler architecture where two-way bindings are desugared into separate property and event bindings, causing them to automatically receive the same sanitizatio..." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:16a0ab9a-94eb-5a98-a0f7-711f0d4325aa", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.9-tuxcare.1 of @angular/upgrade. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature does not exist in this version - it was introduced in Angular v16+. Without this feature, there is no code that hashes HTTP request properties for cache key generation, so the hash collision vulnerability cannot manifest." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:93b08b94-adea-5aa5-92f1-c6ab06d7d468", "id": "CVE-2026-54267", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 15.2.9-tuxcare.1 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.9-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9fbafe7b-2132-5ee1-b730-705c4afabd25", "id": "CVE-2026-54268", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 15.2.9-tuxcare.1 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.9-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@15.2.9-tuxcare.1" } ] }