{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:5816e2e9-7095-579e-97ba-2f1090fe81c3",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/%40angular/animations@15.2.6-tuxcare.2",
      "type": "library",
      "name": "@angular/animations",
      "version": "15.2.6-tuxcare.2",
      "purl": "pkg:npm/%40angular/animations@15.2.6-tuxcare.2"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:284a8b4b-1fc8-5741-b6bc-3a827cc3df61",
      "id": "CVE-2025-66035",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.2.6-tuxcare.2 of @angular/animations."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@15.2.6-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1119c440-a7d0-54dc-9ba3-60195878df5f",
      "id": "CVE-2025-66412",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66412 is fixed in version 15.2.6-tuxcare.2 of @angular/animations."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@15.2.6-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7a665706-fda8-5250-ab8c-aac06e1da4cd",
      "id": "CVE-2026-22610",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22610 is fixed in version 15.2.6-tuxcare.2 of @angular/animations."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@15.2.6-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:91cfa3e9-24d6-58cc-bd07-c31b2eb26e09",
      "id": "CVE-2026-27970",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-27970 is fixed in version 15.2.6-tuxcare.2 of @angular/animations."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@15.2.6-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b70d64d8-f928-5f2c-8f6a-bd2bbef863b8",
      "id": "CVE-2026-41423",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.6-tuxcare.2 of @angular/animations. not_affected \u2014 Target version 15.2.6 is NOT affected by CVE-2026-41423. The target uses Node.js legacy url.parse() API which does NOT interpret protocol-relative URLs (//evil.com) as hostname overrides. The vulnerability only exists when using the WHATWG URL API (new URL()) without input preprocessing, which this version does not use. Testing confirms url.parse('//attacker.com') sets hostname to null (not 'at..."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@15.2.6-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c19fe1c5-f8fc-5fe3-9627-3684d5b6e801",
      "id": "CVE-2026-46417",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.2.6-tuxcare.2 of @angular/animations."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@15.2.6-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ed19a6c8-9743-5656-99f7-5b0b58566e90",
      "id": "CVE-2026-50168",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-50168 does not affect version 15.2.6-tuxcare.2 of @angular/animations. not_affected \u2014 CVE-2026-50168 targets a vulnerability in Angular's platform-server allowedHosts validation feature that allows bypassing hostname restrictions via malformed URLs (e.g., evil.com:80:80). The target repository (Angular v15.2.6-tuxcare.1) does not contain the allowedHosts feature (validateAllowedHosts, isHostAllowed functions) that this CVE exploits. Without the allowedHosts validation mechanism,..."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@15.2.6-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:69b53a48-fa6e-5c75-9d26-59f82a74ed3e",
      "id": "CVE-2026-50169",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50169 is fixed in version 15.2.6-tuxcare.2 of @angular/animations."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@15.2.6-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6b96f922-9f6d-51b9-8478-302b61ff8ed7",
      "id": "CVE-2026-50170",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.6-tuxcare.2 of @angular/animations. not_affected \u2014 Angular version 15.2.6-tuxcare.1 does not contain the HttpTransferCache feature that is the subject of CVE-2026-50170. The vulnerable component (packages/common/http/src/transfer_cache.ts) was introduced in Angular v16.0.0-next.7, after the target version. The vulnerability requires automatic HTTP response caching in TransferState during SSR, which does not exist in v15.2.6."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@15.2.6-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f640c6a3-a12d-5d42-8597-61bd1fe8f881",
      "id": "CVE-2026-50171",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.2.6-tuxcare.2 of @angular/animations."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@15.2.6-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:da930ccc-4d57-5755-9228-8aa16aaf5ca9",
      "id": "CVE-2026-50184",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50184 is fixed in version 15.2.6-tuxcare.2 of @angular/animations."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@15.2.6-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fc70556e-eb49-5f54-9c7e-98ca98e0fddd",
      "id": "CVE-2026-50555",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.2.6-tuxcare.2 of @angular/animations."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@15.2.6-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3a06c1ea-8fe1-5332-9b66-08603c489450",
      "id": "CVE-2026-50556",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.2.6-tuxcare.2 of @angular/animations."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@15.2.6-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:df9f07df-c9fe-5b83-8eb8-5bc76ecc8b4a",
      "id": "CVE-2026-50557",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50557 is fixed in version 15.2.6-tuxcare.2 of @angular/animations."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@15.2.6-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bccf0214-8b05-5400-9c8a-ff37e8c7f6fb",
      "id": "CVE-2026-52725",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-52725 is fixed in version 15.2.6-tuxcare.2 of @angular/animations."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@15.2.6-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:27b1b216-b9c3-5d1e-a929-0ba1ddf82b3d",
      "id": "CVE-2026-54264",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54264 is fixed in version 15.2.6-tuxcare.2 of @angular/animations."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@15.2.6-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fd2c1693-ca6b-505c-b09a-b0dc5812ef44",
      "id": "CVE-2026-54265",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54265 does not affect version 15.2.6-tuxcare.2 of @angular/animations. not_affected \u2014 Angular 15.2.6 is not affected by CVE-2026-54265. The vulnerability is specific to the template pipeline architecture introduced in Angular 20+, which does not exist in Angular 15. Angular 15 uses the older render3 compiler that desugars two-way bindings into standard property bindings at parse time, and these property bindings correctly receive sanitizers."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@15.2.6-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e2159bf9-4f0b-5f11-9af6-16120abb62fe",
      "id": "CVE-2026-54266",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.6-tuxcare.2 of @angular/animations. not_affected \u2014 Angular 15.2.6-tuxcare.1 is not affected by CVE-2026-54266 because the HttpTransferCache feature, including the vulnerable weak DJB2 hash function, was not introduced until Angular v16.0.0. The target version predates the introduction of this feature entirely."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@15.2.6-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0b51e7cd-7208-5375-8f92-9512620e6d5d",
      "id": "CVE-2026-54267",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54267 is fixed in version 15.2.6-tuxcare.2 of @angular/animations."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@15.2.6-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e5fd9dde-c983-5987-9824-9c7f655b6f24",
      "id": "CVE-2026-54268",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.2.6-tuxcare.2 of @angular/animations."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/animations@15.2.6-tuxcare.2"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/animations@15.2.6-tuxcare.2"
    }
  ]
}