{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:99485b92-51d8-5c56-8e3a-c60245a5f91b", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/platform-webworker-dynamic@5.1.2-tuxcare.3", "type": "library", "name": "@angular/platform-webworker-dynamic", "version": "5.1.2-tuxcare.3", "purl": "pkg:npm/%40angular/platform-webworker-dynamic@5.1.2-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:3c94fcbe-c6d7-5ab6-82e6-c0c909efef37", "id": "CVE-2021-4231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-webworker-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6ab1535b-1499-54d7-92b5-a16aa3e3948c", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-webworker-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:304caead-8535-567e-b7a7-543d70989ea2", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-webworker-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8549fed8-d047-5a7e-82cf-a50f23bca57f", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-webworker-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7703cb4f-c390-515b-a7c4-2d261334f721", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-webworker-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1f540b39-270a-5c53-be80-cc9db469f53e", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 5.1.2-tuxcare.3 of @angular/platform-webworker-dynamic. not_affected \u2014 Angular version 5.1.2 is not affected by CVE-2026-41423. The vulnerability requires the WHATWG URL API which exhibits hostname override behavior with protocol-relative URLs. The target uses Node.js's legacy url.parse() API which does not have this behavior." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2f34ec40-c0d8-563b-b754-e78a46b892e7", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-webworker-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c8d432eb-d33f-5d4e-9fc2-4f9d86bf931e", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-webworker-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4780ac38-57f8-5ab4-a05f-cbfa256b9fdd", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-webworker-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:52ff9362-4c31-5e9e-9804-7c7ae7d1804a", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 5.1.2-tuxcare.3 of @angular/platform-webworker-dynamic. not_affected \u2014 no evidence captured" }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d4a937af-d42c-5014-a14c-0c8fa5d42515", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-webworker-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3136ccff-9c1a-52c2-80e4-e5f0dc86d687", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-webworker-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ba66c24e-ebcb-5a88-b510-217f70b39dc1", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-webworker-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bc0d4b5c-b635-58fc-a14e-e552e4d6a85c", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-webworker-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9ef020ff-74f7-57ff-a83c-9888ce595a82", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-webworker-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:556c59e1-592d-5f6b-8de1-cf47b8f4fd30", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-webworker-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:811154f7-e61c-5851-931b-1b1bc6f15a03", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 5.1.2-tuxcare.3 of @angular/platform-webworker-dynamic. not_affected \u2014 Angular v5.1.2-tuxcare.1 is NOT affected by CVE-2026-54264. The vulnerability requires a `newRequestWithMetadata` function that copies request headers, which does not exist in this version. The service worker reconstructs asset requests from URLs only using bare `adapter.newRequest(url)` calls, never copying or forwarding request headers. Therefore, credential headers cannot be leaked on cross-..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c8bb9bf4-fd62-5c46-90cb-0405c7b3f146", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 5.1.2-tuxcare.3 of @angular/platform-webworker-dynamic. not_affected \u2014 Angular 5.1.2 uses the View Engine compiler architecture, which does not have the TwoWayProperty operation kind that is vulnerable in the Ivy compiler. In View Engine, two-way bindings desugar through the same parsePropertyBinding() code path as one-way bindings, ensuring both receive identical security context resolution and sanitization. The vulnerability pattern described in CVE-2026-54265 c..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:074bfffe-18c3-506a-93ee-13d067d3ec0c", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 5.1.2-tuxcare.3 of @angular/platform-webworker-dynamic. not_affected \u2014 Angular 5.1.2 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature that generates cache keys using a weak 32-bit DJB2 hash does not exist in this version. This feature was introduced in Angular v16+, while the target is v5.1.2. Although TransferState exists in this version for basic state transfer, there is no integration with HttpClient for automatic response caching, no..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ca7d76c4-2b64-5a27-bc19-8eac19cb1e58", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-webworker-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@5.1.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3c6fbbe6-985d-576e-bde8-bcbb12918f98", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.1.2-tuxcare.3 of @angular/platform-webworker-dynamic." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@5.1.2-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-webworker-dynamic@5.1.2-tuxcare.3" } ] }