{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b59b33ce-114a-5db7-b48a-bd04a8470a02", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/localize@15.2.9-tuxcare.2", "type": "library", "name": "@angular/localize", "version": "15.2.9-tuxcare.2", "purl": "pkg:npm/%40angular/localize@15.2.9-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:f08d0be2-f3a7-56f5-977b-2560f6829305", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.2.9-tuxcare.2 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:727a2fd3-b165-54b4-aca5-5b8638f164fb", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 15.2.9-tuxcare.2 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cc15d9f5-7181-50d8-9464-630dc36ccb51", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 15.2.9-tuxcare.2 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:192f1cb8-191c-54c0-ad41-39560c04f902", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 15.2.9-tuxcare.2 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:9d44753d-7895-5bc3-afb3-b2d509d94bf4", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.9-tuxcare.2 of @angular/localize. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-41423. The SSRF vulnerability via protocol-relative URLs was introduced in Angular 17.0.0 when the codebase switched from Node.js url.parse to WHATWG URL API. Angular 15.2.9 still uses the legacy Node.js url.parse which treats protocol-relative URLs ('//evil.com') as pathnames, not hostname overrides, preventing the SSRF attack vector." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6816b958-8ff3-5261-8cee-12cb79899235", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.2.9-tuxcare.2 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0cb3aceb-7618-5b87-b3c1-bf43b9d160b2", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 15.2.9-tuxcare.2 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4cc3ceb3-d8d1-506a-945d-f15726bfc5d5", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 15.2.9-tuxcare.2 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:541604d4-fc53-5da8-8d73-d4e532f47345", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.9-tuxcare.2 of @angular/localize. not_affected \u2014 no evidence captured" }, "affects": [ { "ref": "pkg:npm/%40angular/localize@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fea86729-e2dc-5b44-a60a-b48d1b73582e", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.2.9-tuxcare.2 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d3c7495a-3b51-5ba5-950c-dd8ef2d84f28", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 15.2.9-tuxcare.2 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:634a9cc3-7c98-5f80-b67c-7c5d9b94c6d4", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.2.9-tuxcare.2 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:560df0cd-1393-5c51-94c8-a81e8920e295", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.2.9-tuxcare.2 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:967d405f-6c69-55a4-aa18-1568886999f8", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 15.2.9-tuxcare.2 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4e3d4ab2-3c08-5aed-abfe-d23b8516d270", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 15.2.9-tuxcare.2 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:488ae60a-5484-5c0e-bcb4-070afc3218e8", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 15.2.9-tuxcare.2 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7c279dbe-bbc4-5281-9c94-8d361738df9a", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.2.9-tuxcare.2 of @angular/localize. not_affected \u2014 Angular 15.2.9-tuxcare.1 is not affected by CVE-2026-54265. The vulnerability requires the new Ivy compiler 'pipeline' architecture with the TwoWayProperty IR operation, which was introduced in Angular 16+. Angular 15.2.9 uses the older compiler architecture where two-way bindings are desugared into separate property and event bindings, causing them to automatically receive the same sanitizatio..." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:81f435bc-55e0-5719-a8f8-183f8f6c7131", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.9-tuxcare.2 of @angular/localize. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature does not exist in this version - it was introduced in Angular v16+. Without this feature, there is no code that hashes HTTP request properties for cache key generation, so the hash collision vulnerability cannot manifest." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:52827b37-85f5-50a2-a6fd-07443eadd318", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 15.2.9-tuxcare.2 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@15.2.9-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:31348449-93d4-5c63-a9b0-00950b9314a1", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.2.9-tuxcare.2 of @angular/localize." }, "affects": [ { "ref": "pkg:npm/%40angular/localize@15.2.9-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/localize@15.2.9-tuxcare.2" } ] }