{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:23a581d8-0e95-5a16-abea-0bd2c41c598d", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/animations@15.2.9-tuxcare.2", "type": "library", "name": "@angular/animations", "version": "15.2.9-tuxcare.2", "purl": "pkg:npm/%40angular/animations@15.2.9-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:c6dadc2b-072c-523a-acb9-501584fc68ac", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.2.9-tuxcare.2 of @angular/animations." }, "affects": [ { "ref": "pkg:npm/%40angular/animations@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:524fc55e-0789-56c7-a432-ed815ba57b9f", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 15.2.9-tuxcare.2 of @angular/animations." }, "affects": [ { "ref": "pkg:npm/%40angular/animations@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5d2640b4-9ef3-5a97-a297-16f4df7ffe10", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 15.2.9-tuxcare.2 of @angular/animations." }, "affects": [ { "ref": "pkg:npm/%40angular/animations@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8cdacb1c-809f-53e6-91ce-43c25cfd3f12", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 15.2.9-tuxcare.2 of @angular/animations." }, "affects": [ { "ref": "pkg:npm/%40angular/animations@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1f53fb54-4205-5fcb-adc9-937275b19c08", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.9-tuxcare.2 of @angular/animations. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-41423. The SSRF vulnerability via protocol-relative URLs was introduced in Angular 17.0.0 when the codebase switched from Node.js url.parse to WHATWG URL API. Angular 15.2.9 still uses the legacy Node.js url.parse which treats protocol-relative URLs ('//evil.com') as pathnames, not hostname overrides, preventing the SSRF attack vector." }, "affects": [ { "ref": "pkg:npm/%40angular/animations@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d14171d8-441b-5ed6-8c1e-0932b91423d5", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.2.9-tuxcare.2 of @angular/animations." }, "affects": [ { "ref": "pkg:npm/%40angular/animations@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2a796f69-0495-5870-81d0-1c9a9002d5a8", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 15.2.9-tuxcare.2 of @angular/animations." }, "affects": [ { "ref": "pkg:npm/%40angular/animations@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:da40b248-7e47-5250-8925-791d386061c2", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 15.2.9-tuxcare.2 of @angular/animations." }, "affects": [ { "ref": "pkg:npm/%40angular/animations@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8292e634-1823-5bfb-9dc7-cd6173970032", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.9-tuxcare.2 of @angular/animations. not_affected \u2014 no evidence captured" }, "affects": [ { "ref": "pkg:npm/%40angular/animations@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0bf80c53-3625-51a5-a056-c8068af310d9", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.2.9-tuxcare.2 of @angular/animations." }, "affects": [ { "ref": "pkg:npm/%40angular/animations@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1571067e-30d1-5806-ae4a-19bced2fc590", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 15.2.9-tuxcare.2 of @angular/animations." }, "affects": [ { "ref": "pkg:npm/%40angular/animations@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3090fdd1-4448-53d0-8c1d-3b540646ed39", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.2.9-tuxcare.2 of @angular/animations." }, "affects": [ { "ref": "pkg:npm/%40angular/animations@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e0528118-0e39-512f-9cd2-3198325a9dfc", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.2.9-tuxcare.2 of @angular/animations." }, "affects": [ { "ref": "pkg:npm/%40angular/animations@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2b90b86f-cfd3-5db2-a25f-fb4ce24158f3", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 15.2.9-tuxcare.2 of @angular/animations." }, "affects": [ { "ref": "pkg:npm/%40angular/animations@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4d2d8edf-72b8-5f65-8485-3a8a08eac903", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 15.2.9-tuxcare.2 of @angular/animations." }, "affects": [ { "ref": "pkg:npm/%40angular/animations@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c36090b0-9382-5503-aeae-2cefdc2cc68d", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 15.2.9-tuxcare.2 of @angular/animations." }, "affects": [ { "ref": "pkg:npm/%40angular/animations@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cc588327-a5fd-53f6-9768-9815201da9bf", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.2.9-tuxcare.2 of @angular/animations. not_affected \u2014 Angular 15.2.9-tuxcare.1 is not affected by CVE-2026-54265. The vulnerability requires the new Ivy compiler 'pipeline' architecture with the TwoWayProperty IR operation, which was introduced in Angular 16+. Angular 15.2.9 uses the older compiler architecture where two-way bindings are desugared into separate property and event bindings, causing them to automatically receive the same sanitizatio..." }, "affects": [ { "ref": "pkg:npm/%40angular/animations@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d52f4229-d6de-5162-a014-e79d9981f066", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.9-tuxcare.2 of @angular/animations. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature does not exist in this version - it was introduced in Angular v16+. Without this feature, there is no code that hashes HTTP request properties for cache key generation, so the hash collision vulnerability cannot manifest." }, "affects": [ { "ref": "pkg:npm/%40angular/animations@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8a4fdf3d-cd1d-5c52-bc6a-08738ee3abe0", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 15.2.9-tuxcare.2 of @angular/animations." }, "affects": [ { "ref": "pkg:npm/%40angular/animations@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:359f74f2-85c5-5ea9-a43d-4e9747565dda", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.2.9-tuxcare.2 of @angular/animations." }, "affects": [ { "ref": "pkg:npm/%40angular/animations@15.2.9-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/animations@15.2.9-tuxcare.2" } ] }