{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3f78c3bb-c81e-5d77-8e66-02b3f7ac3c2f", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.3", "type": "library", "name": "@angular/platform-browser-dynamic", "version": "5.1.2-tuxcare.3", "purl": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:8d1b94e6-998a-501e-bf40-644658da8229", "id": "CVE-2021-4231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ace7a327-a35a-5912-9cba-3552d37a59ed", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1557b092-a064-583e-9e78-0ed3a8bdedff", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ac7afa64-382f-5d9a-b18b-055d2776a581", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cf2af468-2d75-53c9-8824-cb93de96eb49", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:79ae740f-ae41-5528-806c-7570f4b5e284", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 5.1.2-tuxcare.3 of @angular/platform-browser-dynamic. not_affected \u2014 Angular version 5.1.2 is not affected by CVE-2026-41423. The vulnerability requires the WHATWG URL API which exhibits hostname override behavior with protocol-relative URLs. The target uses Node.js's legacy url.parse() API which does not have this behavior." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1325351d-ec9c-5088-b595-4192a77adb05", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6d64fd7b-1af2-5a13-83c3-94cd1d04854d", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ba79447b-cf12-5e00-84e7-cdcae433b5dd", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3c17a0d6-0d34-5608-bb5f-b9b8fe536a18", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 5.1.2-tuxcare.3 of @angular/platform-browser-dynamic. not_affected \u2014 no evidence captured" }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:937b8cee-d4e5-58cd-acdf-8af7860676f0", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:72c867bd-e01f-5231-9599-7b0f9d1bd5a7", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:20f1e622-c5fb-5a2b-a8f0-10ab512ead9f", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ae705a27-8cff-5828-8c4f-9717619cc8b1", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:dd5e0745-2c94-56a7-b427-d343028755e9", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:12542fc3-3838-59a8-8cf2-948429173f1d", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bd1dfdb3-c28e-5446-8093-8d9644579ec4", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 5.1.2-tuxcare.3 of @angular/platform-browser-dynamic. not_affected \u2014 Angular v5.1.2-tuxcare.1 is NOT affected by CVE-2026-54264. The vulnerability requires a `newRequestWithMetadata` function that copies request headers, which does not exist in this version. The service worker reconstructs asset requests from URLs only using bare `adapter.newRequest(url)` calls, never copying or forwarding request headers. Therefore, credential headers cannot be leaked on cross-..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2022c3e0-0f0f-50ca-b87b-e2dcdc52efe5", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 5.1.2-tuxcare.3 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 5.1.2 uses the View Engine compiler architecture, which does not have the TwoWayProperty operation kind that is vulnerable in the Ivy compiler. In View Engine, two-way bindings desugar through the same parsePropertyBinding() code path as one-way bindings, ensuring both receive identical security context resolution and sanitization. The vulnerability pattern described in CVE-2026-54265 c..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c4a05704-4b95-593c-bc51-7b382a71624f", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 5.1.2-tuxcare.3 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 5.1.2 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature that generates cache keys using a weak 32-bit DJB2 hash does not exist in this version. This feature was introduced in Angular v16+, while the target is v5.1.2. Although TransferState exists in this version for basic state transfer, there is no integration with HttpClient for automatic response caching, no..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0021b66f-f05b-5202-b7d5-6920f331ed8b", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1e34b63a-efd2-597a-b0c3-35bf5f7146e4", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-browser-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@5.1.2-tuxcare.3" } ] }