{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ab64b0d8-d009-564e-a069-b0e880fb87cf", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.3", "type": "library", "name": "@angular/platform-webworker", "version": "7.2.11-tuxcare.3", "purl": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:c00f924f-d1ca-5f62-a661-af726c96bb57", "id": "CVE-2021-4231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 7.2.11-tuxcare.3 of @angular/platform-webworker." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:51381780-2871-50bc-b48c-d78ec951828d", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 7.2.11-tuxcare.3 of @angular/platform-webworker." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e693b168-b7cd-5e00-adb4-092fad31d9a6", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 7.2.11-tuxcare.3 of @angular/platform-webworker." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3d049a1f-844b-5383-9549-8bcaf94531ac", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 7.2.11-tuxcare.3 of @angular/platform-webworker." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:89972ee3-3895-5f11-8778-0638423547c0", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 7.2.11-tuxcare.3 of @angular/platform-webworker." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9a251609-859b-5604-91c8-871c542647e0", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 7.2.11-tuxcare.3 of @angular/platform-webworker." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2200c582-0152-5c45-9f11-7ed34c18d6d9", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 7.2.11-tuxcare.3 of @angular/platform-webworker." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5e3b8696-b90a-59e6-8e4e-97578a6ab4b7", "id": "CVE-2026-50168", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50168 does not affect version 7.2.11-tuxcare.3 of @angular/platform-webworker. not_affected \u2014 CVE-2026-50168 addresses vulnerabilities in the WHATWG URL-based parseUrl implementation and allowedHosts validation feature introduced in Angular's CVE-2026-41423 fix. The target (v7.2.11) uses a completely different architecture with Node.js legacy url.parse() and does not have the allowedHosts feature. The specific vulnerable code patterns that CVE-2026-50168 patches do not exist in this ver..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9bada345-5657-53db-b123-3d2d9fc9a0c5", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 7.2.11-tuxcare.3 of @angular/platform-webworker." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6debe5df-697e-5b75-93fe-cafa9e03edcb", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 7.2.11-tuxcare.3 of @angular/platform-webworker. not_affected \u2014 Angular v7.2.11 is not affected by CVE-2026-50170. The HTTP Transfer Cache feature that is vulnerable does not exist in this version. The feature was introduced in Angular v16+, and v7.2.11 lacks the transfer_cache.ts module, withHttpTransferCache provider, and provideClientHydration functionality entirely." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:511733f1-815d-540d-be4b-8411c1baf22e", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 7.2.11-tuxcare.3 of @angular/platform-webworker." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:600f81ef-6012-58cd-ba89-350afa39feb9", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 7.2.11-tuxcare.3 of @angular/platform-webworker." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d70f4e12-70d9-5e28-a09c-ef0bac266eb8", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 7.2.11-tuxcare.3 of @angular/platform-webworker." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ab5bb117-50d3-5c40-98cf-e34bdb70052d", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 7.2.11-tuxcare.3 of @angular/platform-webworker." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2e52ee5e-735f-54a6-93c8-84980d390302", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 7.2.11-tuxcare.3 of @angular/platform-webworker." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7be58b67-51b5-5327-a66b-f3cc92b5b1b2", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 7.2.11-tuxcare.3 of @angular/platform-webworker." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fadaafea-9bae-5756-a9c9-0d7e87c3a8ec", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 7.2.11-tuxcare.3 of @angular/platform-webworker. not_affected \u2014 Angular 7.2.11-tuxcare.2 is not affected by CVE-2026-54264. The vulnerability concerns sensitive header leakage on cross-origin redirects in the request metadata preservation feature. This version predates that feature entirely - it strips ALL request headers when making network requests for assets, as evidenced by code comments and the absence of the newRequestWithMetadata method introduced in..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:227f99aa-9f61-56fb-a78c-b5df3589cb05", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 7.2.11-tuxcare.3 of @angular/platform-webworker. not_affected \u2014 Angular 7.2.11-tuxcare.2 uses View Engine compiler architecture, not Ivy. The vulnerability (CVE-2026-54265) is specific to Ivy's template compiler pipeline where TwoWayProperty operations were missing from the sanitizer resolution switch. View Engine does not have TwoWayProperty operations; two-way bindings desugar early in the template parser to the same parsePropertyBinding() code path as on..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c3290039-c3df-5284-9dcf-1865921e8632", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 7.2.11-tuxcare.3 of @angular/platform-webworker. not_affected \u2014 Angular 7.2.11-tuxcare.2 is not affected by CVE-2026-54266. The HttpTransferCache feature that contains the weak hash vulnerability does not exist in this version - it was introduced in Angular 16." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9cca757c-36df-50c1-924f-a8a7b20b54f8", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 7.2.11-tuxcare.3 of @angular/platform-webworker." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c54142f7-5481-5ee4-ab5a-74d3f71ec9a2", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 7.2.11-tuxcare.3 of @angular/platform-webworker." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-webworker@7.2.11-tuxcare.3" } ] }