{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2d23584b-18e4-553b-bf16-cced6f073274", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12-tuxcare.2", "type": "library", "name": "@angular/platform-browser-dynamic", "version": "13.3.12-tuxcare.2", "purl": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:7faa15f2-2710-567f-a9c8-551567d61e95", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 13.3.12-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b3ef2297-0052-5e7e-a0aa-608fa47a88f9", "id": "CVE-2025-66412", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 13.3.12-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:de8c62c2-e01b-50a1-b4b0-6499fea95746", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 13.3.12-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f1f8b3c9-41a3-5f8b-b931-4bd18787d642", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 13.3.12-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c5a355ce-8202-53a8-a139-f893a7859338", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 13.3.12-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:35fbf1da-07ff-5910-83ab-0e9c2f3bc664", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 13.3.12-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:45b5168f-c148-5366-bc2b-d07b14efb25e", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 13.3.12-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fead400e-90d6-5c0c-a22e-86b736f8335c", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 13.3.12-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5cf2bcf4-1161-5168-94c1-72a20767e67a", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 13.3.12-tuxcare.2 of @angular/platform-browser-dynamic. not_affected \u2014 Angular v13.3.12 is NOT AFFECTED by CVE-2026-50170. The HttpTransferCache feature that contains the vulnerability was introduced in Angular v16.0.0 (March 2023) and does not exist in this earlier version." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b409676c-d8ee-5072-908a-f7607ce2ab45", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 13.3.12-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2b78d4a6-99ec-5891-b6cd-501ea5ffef9b", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 13.3.12-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:bfbd2128-70b8-5c1d-a7de-921350f067a9", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 13.3.12-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f42b32a4-e296-5725-9f7e-105420567886", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 13.3.12-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5d7cd24c-d7ef-51c5-974d-04a7e65fc5f3", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 13.3.12-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2ba18187-f8b9-5862-b8b3-df098b1314b0", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 13.3.12-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7e39a977-53b6-5ad8-92e6-e30679ffa744", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 13.3.12-tuxcare.2 of @angular/platform-browser-dynamic. not_affected \u2014 Version 13.3.12 does not have the vulnerable code pattern. The vulnerability exists in versions 20.x+ where the Service Worker's newRequestWithMetadata function preserves request headers but fails to strip sensitive headers on cross-origin redirects. Version 13.3.12 lacks this function entirely and creates fresh requests with URL-only when handling redirects, preventing header leakage." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c234232d-c1d4-583b-9e86-825d89d2c420", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 13.3.12-tuxcare.2 of @angular/platform-browser-dynamic. not_affected \u2014 Angular v13.3.12-tuxcare.1 is not affected by CVE-2026-54265. The vulnerability is specific to the Ivy template pipeline architecture (TwoWayProperty operation) introduced in Angular v17+. This version uses an older Ivy architecture where two-way bindings desugar through the same sanitized property binding path as one-way bindings, preventing the sanitization bypass." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c8418b18-3a54-5e3b-ae24-f4a7654474c4", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 13.3.12-tuxcare.2 of @angular/platform-browser-dynamic. not_affected \u2014 Angular v13.3.12 is NOT AFFECTED by CVE-2026-54266. The vulnerable HttpTransferCache feature with weak DJB2 hash-based cache key generation was introduced in Angular v16.0.0-next.7 (March 2023), which is 3+ major versions newer than this target version. Exhaustive code analysis confirms the transfer_cache.ts module, HttpTransferCache class, generateHash function, and all related cache key gener..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fa134ec5-2f93-577e-80dd-0d3a8e1ffa32", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 13.3.12-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3fea6f35-ae24-5513-adfd-40408f6f0c6e", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 13.3.12-tuxcare.2 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@13.3.12-tuxcare.2" } ] }