{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:305fc774-4d64-5867-84f9-2e6129c1fb57", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.2", "type": "library", "name": "@angular/benchpress", "version": "15.2.9-tuxcare.2", "purl": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:6574e506-1f30-5776-8f4f-3c52fab81f49", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.2.9-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c0db9cb6-56e1-5f56-8d25-2aaed1f7eaa8", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 15.2.9-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fc1183f2-6200-5d43-80f1-99e7d5b74e70", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 15.2.9-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c3f8a8f3-477f-5503-828f-80c9a0212085", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 15.2.9-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:dff97b8c-ab5a-56e6-b09b-82d6f8ba11d1", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.9-tuxcare.2 of @angular/benchpress. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-41423. The SSRF vulnerability via protocol-relative URLs was introduced in Angular 17.0.0 when the codebase switched from Node.js url.parse to WHATWG URL API. Angular 15.2.9 still uses the legacy Node.js url.parse which treats protocol-relative URLs ('//evil.com') as pathnames, not hostname overrides, preventing the SSRF attack vector." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5d604734-3808-55f4-b935-45bc93ad198a", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.2.9-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:554c4951-572c-52a1-a5da-9c4050308e8e", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 15.2.9-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cbd6ba5d-808b-520c-854a-a4aaf4c7dfd8", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 15.2.9-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:07d6f770-d573-5cee-9645-629b8249b07c", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.9-tuxcare.2 of @angular/benchpress. not_affected \u2014 no evidence captured" }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:874757e1-a667-5848-a192-fb501d71bda7", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.2.9-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d2f20c89-9453-50d7-b3e7-4b8e7c0db7bd", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 15.2.9-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:bedc3f65-1ccc-571d-b7bd-727a961ed910", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.2.9-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:9e1e648f-107e-5cda-8ebe-61ed232a5e94", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.2.9-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d9b51b66-44bf-5168-a116-96f24bb2844e", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 15.2.9-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b314fd23-2d74-58d0-abcb-f0afa05ea89a", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 15.2.9-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:838db474-5f67-57c3-8eb2-83834c3c38cc", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 15.2.9-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:546afe5a-fe5e-5fb9-9ec9-a527d5af99b8", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.2.9-tuxcare.2 of @angular/benchpress. not_affected \u2014 Angular 15.2.9-tuxcare.1 is not affected by CVE-2026-54265. The vulnerability requires the new Ivy compiler 'pipeline' architecture with the TwoWayProperty IR operation, which was introduced in Angular 16+. Angular 15.2.9 uses the older compiler architecture where two-way bindings are desugared into separate property and event bindings, causing them to automatically receive the same sanitizatio..." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6bc0a0ec-e1a1-53d6-aeac-fdebaf595273", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.9-tuxcare.2 of @angular/benchpress. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature does not exist in this version - it was introduced in Angular v16+. Without this feature, there is no code that hashes HTTP request properties for cache key generation, so the hash collision vulnerability cannot manifest." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5c477636-105f-5b15-a884-b67e32a3f005", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 15.2.9-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0a9073ab-4670-57fe-ade5-c878aebe8130", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.2.9-tuxcare.2 of @angular/benchpress." }, "affects": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/benchpress@15.2.9-tuxcare.2" } ] }