{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bca2fe45-3e5e-50e3-8685-b86508037d3c", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/benchpress@15.0.3-tuxcare.2", "type": "library", "name": "@angular/benchpress", "version": "15.0.3-tuxcare.2", "purl": "pkg:npm/%40angular/benchpress@15.0.3-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:5bf736c4-cf45-5b74-97a2-4652b03cdcd9", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.0.3-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:58e051eb-966a-5907-8f26-9cd9e3851e5f", "id": "CVE-2025-66412", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 15.0.3-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7240e811-4641-5906-ab61-ef5f348ec015", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 15.0.3-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e2da8597-152c-5656-95f4-5467e79c7636", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 15.0.3-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:32b6fc02-9110-575e-b324-67854a323ed2", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 15.0.3-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3cca1cc1-ad31-5b50-8873-7968b1f0e0a6", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.0.3-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:218440d0-3990-5af9-bfb6-5fe5d771e663", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 15.0.3-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:9a9a1625-93e6-569a-8cae-7586d91fb097", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 15.0.3-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c7c964ab-69a3-5c7e-bab7-6ba5798cdfd8", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.0.3-tuxcare.2 of @angular/benchpress. not_affected \u2014 Angular 15.0.3-tuxcare.1 is NOT affected by CVE-2026-50170. The HTTP TransferCache feature that is vulnerable in later Angular versions (v16+) does not exist in this version. The vulnerable code (transfer_cache.ts, hasAuthHeaders(), shouldCacheRequest(), withHttpTransferCache, provideClientHydration) is absent from Angular 15.0.3." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cae3af46-80fb-5990-a8fb-63706f509d98", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.0.3-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e618a8b0-402d-55bd-b7fd-ee52f9e41e1d", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 15.0.3-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7b37b98a-0ce0-587a-9722-96c5181e878c", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.0.3-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:473231a6-3e79-52c4-b645-f67784eab6f1", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.0.3-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d8a462f9-8bfd-5b80-a8c3-cd21a509e7b6", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 15.0.3-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:eaabfbd9-4814-5e6b-86b1-68f9558782ac", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 15.0.3-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4d6bfa43-2923-56b8-87f5-9ca2dff9666d", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 15.0.3-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a601f48e-0f58-5abd-9bf9-a4ed3fd5a030", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.0.3-tuxcare.2 of @angular/benchpress. not_affected \u2014 Angular 15.0.3 is NOT AFFECTED by CVE-2026-54265. This version uses a different compiler architecture where two-way bindings desugar through the same code path as one-way bindings, both receiving identical security context resolution and sanitizer assignment. The vulnerable code (Ivy template pipeline with separate TwoWayProperty operation type) does not exist in this version." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:63d6170f-b871-5c2c-ad79-a27c55e7fee3", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.0.3-tuxcare.2 of @angular/benchpress. not_affected \u2014 Angular v15.0.3-tuxcare.1 is NOT affected by CVE-2026-54266. The vulnerable HttpTransferCache feature with weak DJB2 hash-based cache keys does not exist in this version. This feature was introduced in Angular v16+. The target has no code path from HTTP request handling to the vulnerability's cache poisoning goal." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:32ec0931-c059-5abf-90d8-95846c55afeb", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 15.0.3-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f4585491-ae3b-5e39-bd0c-08748a8f3b26", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.0.3-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.0.3-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/benchpress@15.0.3-tuxcare.2" } ] }