{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:aff0db4d-ad83-5ec3-a424-78881f363b93", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/bazel@15.2.9-tuxcare.2", "type": "library", "name": "@angular/bazel", "version": "15.2.9-tuxcare.2", "purl": "pkg:npm/%40angular/bazel@15.2.9-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:3c982e2d-1ba8-57cc-9991-1905daef7c7c", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.2.9-tuxcare.2 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:09c52c1d-c8f0-5a4a-83df-92bb6af94895", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 15.2.9-tuxcare.2 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:70129c94-845e-544a-a731-6c635c2f6c6c", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 15.2.9-tuxcare.2 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d2ae5eb8-f984-5a8a-b2a6-f5e0797c5706", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 15.2.9-tuxcare.2 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:862183be-1568-50b6-96b4-eeaad928ed65", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.9-tuxcare.2 of @angular/bazel. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-41423. The SSRF vulnerability via protocol-relative URLs was introduced in Angular 17.0.0 when the codebase switched from Node.js url.parse to WHATWG URL API. Angular 15.2.9 still uses the legacy Node.js url.parse which treats protocol-relative URLs ('//evil.com') as pathnames, not hostname overrides, preventing the SSRF attack vector." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:120d60d0-97b7-5828-bb33-43ebafd3afce", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.2.9-tuxcare.2 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c0c09b80-0bbb-580a-9e98-4ecc598e9424", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 15.2.9-tuxcare.2 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2bab9a1a-57ff-58f6-af89-bb57593cd26b", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 15.2.9-tuxcare.2 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:337b58cd-b27d-52d8-8ba0-b664d5b0a03e", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.9-tuxcare.2 of @angular/bazel. not_affected \u2014 no evidence captured" }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b07a20e9-e520-5a69-ad36-d93d8a1082f7", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.2.9-tuxcare.2 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8200aa5c-5999-545e-8dde-b2349b11d78b", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 15.2.9-tuxcare.2 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:85cc0308-2bce-5b04-8188-47b08f3b42a3", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.2.9-tuxcare.2 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b6d7c7f4-75f6-55d9-8a4d-75c7bcc799d4", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.2.9-tuxcare.2 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c5b06a45-96e2-5a7f-8317-20379fd96ca6", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 15.2.9-tuxcare.2 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1162ff02-8392-5d9f-bc99-2acee89ac469", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 15.2.9-tuxcare.2 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cb55ffda-a2a4-5563-b7f1-36b003e1e481", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 15.2.9-tuxcare.2 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c0549d4d-7ab6-5068-98dc-074c70c3e120", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.2.9-tuxcare.2 of @angular/bazel. not_affected \u2014 Angular 15.2.9-tuxcare.1 is not affected by CVE-2026-54265. The vulnerability requires the new Ivy compiler 'pipeline' architecture with the TwoWayProperty IR operation, which was introduced in Angular 16+. Angular 15.2.9 uses the older compiler architecture where two-way bindings are desugared into separate property and event bindings, causing them to automatically receive the same sanitizatio..." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7425726b-51b3-5641-acc6-f9a5bfb23a1a", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.9-tuxcare.2 of @angular/bazel. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature does not exist in this version - it was introduced in Angular v16+. Without this feature, there is no code that hashes HTTP request properties for cache key generation, so the hash collision vulnerability cannot manifest." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fcb22afb-e7f1-58b7-9017-0521f2e6a00e", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 15.2.9-tuxcare.2 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4104d703-57dc-5c31-ba78-5b506843e114", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.2.9-tuxcare.2 of @angular/bazel." }, "affects": [ { "ref": "pkg:npm/%40angular/bazel@15.2.9-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/bazel@15.2.9-tuxcare.2" } ] }