{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:89885154-98af-558f-8f22-6685f872da13", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.2", "type": "library", "name": "@angular/elements", "version": "15.2.9-tuxcare.2", "purl": "pkg:npm/%40angular/elements@15.2.9-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:98267096-b137-5bea-a7ae-934419777f50", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.2.9-tuxcare.2 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:18a6184d-8b89-5d6a-8355-11906d051c0f", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 15.2.9-tuxcare.2 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:dd5d45bf-fa2a-5113-98df-97b978e6a0bd", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 15.2.9-tuxcare.2 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2bff33ef-8639-5074-8cfd-8cd8119cb6ad", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 15.2.9-tuxcare.2 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:32097a89-6656-5b7b-8c02-657951c77c3c", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.9-tuxcare.2 of @angular/elements. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-41423. The SSRF vulnerability via protocol-relative URLs was introduced in Angular 17.0.0 when the codebase switched from Node.js url.parse to WHATWG URL API. Angular 15.2.9 still uses the legacy Node.js url.parse which treats protocol-relative URLs ('//evil.com') as pathnames, not hostname overrides, preventing the SSRF attack vector." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:324ed0ba-4950-583d-999b-2bd91d1c55d2", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.2.9-tuxcare.2 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:917fd69d-602f-578d-b448-eb441b00dd94", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 15.2.9-tuxcare.2 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cfec0f22-736b-5fcd-b58c-584276a4ce1a", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 15.2.9-tuxcare.2 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:246acb97-7727-556e-a22e-8641513aa673", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.9-tuxcare.2 of @angular/elements. not_affected \u2014 no evidence captured" }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d6732a5f-fabd-5ace-bf49-290df18ce527", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.2.9-tuxcare.2 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a4b9759b-ca88-5a12-ada1-c9b727fbeb03", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 15.2.9-tuxcare.2 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:550d2cf0-9adb-5c3e-9ef9-7e848413991b", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.2.9-tuxcare.2 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:006520b5-9353-5289-ae02-47558380c236", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.2.9-tuxcare.2 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7eb26548-c550-5abf-8387-d502611f94e7", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 15.2.9-tuxcare.2 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0f1a8d40-725e-56ec-a1b1-f27dc9b6b390", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 15.2.9-tuxcare.2 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c39a2a12-8819-559a-abbd-6905dd3231b7", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 15.2.9-tuxcare.2 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:63db8f53-595c-5edd-85f7-6afec497406b", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.2.9-tuxcare.2 of @angular/elements. not_affected \u2014 Angular 15.2.9-tuxcare.1 is not affected by CVE-2026-54265. The vulnerability requires the new Ivy compiler 'pipeline' architecture with the TwoWayProperty IR operation, which was introduced in Angular 16+. Angular 15.2.9 uses the older compiler architecture where two-way bindings are desugared into separate property and event bindings, causing them to automatically receive the same sanitizatio..." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:74715b6b-0d2c-5cf8-8260-fdff5235ed2f", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.9-tuxcare.2 of @angular/elements. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature does not exist in this version - it was introduced in Angular v16+. Without this feature, there is no code that hashes HTTP request properties for cache key generation, so the hash collision vulnerability cannot manifest." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:24333af5-7a51-5b54-bf0e-cf5913ac4353", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 15.2.9-tuxcare.2 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2ac478d4-e091-5ef5-9d6d-df51b0c29155", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.2.9-tuxcare.2 of @angular/elements." }, "affects": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/elements@15.2.9-tuxcare.2" } ] }