{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:95392955-9a52-53cf-8e27-1b0b08f5201d", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/platform-browser@15.0.3-tuxcare.2", "type": "library", "name": "@angular/platform-browser", "version": "15.0.3-tuxcare.2", "purl": "pkg:npm/%40angular/platform-browser@15.0.3-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:99a7c23c-cfe8-560c-a0e4-96f511da7238", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.0.3-tuxcare.2 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:42c887bb-f998-5e4f-b1e8-5dbfbb53a840", "id": "CVE-2025-66412", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 15.0.3-tuxcare.2 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:9772d25a-9954-5ff7-bbdb-f1da6c534a72", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 15.0.3-tuxcare.2 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:485477c3-6164-529f-acd3-13ac0bce4d0a", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 15.0.3-tuxcare.2 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2174d1bd-89d3-538c-b624-a550b1d3a2ef", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 15.0.3-tuxcare.2 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c88dfaa6-9a13-5c00-830c-033aa0a494a2", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.0.3-tuxcare.2 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a47890fe-3b17-559e-89f5-f93476e40fb8", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 15.0.3-tuxcare.2 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:9c431def-23d3-5f0b-a824-371b3763f1cf", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 15.0.3-tuxcare.2 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e771c8c4-f7f1-5352-b79e-52927906b19a", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.0.3-tuxcare.2 of @angular/platform-browser. not_affected \u2014 Angular 15.0.3-tuxcare.1 is NOT affected by CVE-2026-50170. The HTTP TransferCache feature that is vulnerable in later Angular versions (v16+) does not exist in this version. The vulnerable code (transfer_cache.ts, hasAuthHeaders(), shouldCacheRequest(), withHttpTransferCache, provideClientHydration) is absent from Angular 15.0.3." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e37078dd-7d6a-59a4-aa9e-8efe7ec3504b", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.0.3-tuxcare.2 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1c5c6f79-b532-5df5-9bca-39c7874a211d", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 15.0.3-tuxcare.2 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:bca82756-38a8-5ab4-8316-9c084655e215", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.0.3-tuxcare.2 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:426ed540-dd59-5e77-b71d-c5df21319a0c", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.0.3-tuxcare.2 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:95f071bc-20ff-59f2-85b7-7c81b12fb6db", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 15.0.3-tuxcare.2 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b6def6e5-4171-5e1f-9716-e99ebe9ea72e", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 15.0.3-tuxcare.2 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:55921ec6-b6dc-510e-839f-a1ed49956527", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 15.0.3-tuxcare.2 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:9bc2693c-58e8-53e6-8ff6-e2052005dff6", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.0.3-tuxcare.2 of @angular/platform-browser. not_affected \u2014 Angular 15.0.3 is NOT AFFECTED by CVE-2026-54265. This version uses a different compiler architecture where two-way bindings desugar through the same code path as one-way bindings, both receiving identical security context resolution and sanitizer assignment. The vulnerable code (Ivy template pipeline with separate TwoWayProperty operation type) does not exist in this version." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5c395f01-c47c-5977-94d4-d598a5c9717d", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.0.3-tuxcare.2 of @angular/platform-browser. not_affected \u2014 Angular v15.0.3-tuxcare.1 is NOT affected by CVE-2026-54266. The vulnerable HttpTransferCache feature with weak DJB2 hash-based cache keys does not exist in this version. This feature was introduced in Angular v16+. The target has no code path from HTTP request handling to the vulnerability's cache poisoning goal." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2055c474-f494-5362-9c57-5e6c3be8607e", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 15.0.3-tuxcare.2 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c81e845c-31e8-5392-9eb6-fbaa3b76a113", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.0.3-tuxcare.2 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@15.0.3-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser@15.0.3-tuxcare.2" } ] }