{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bdd1573f-3061-5876-b209-48bad9701e6e", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.2", "type": "library", "name": "@angular/service-worker", "version": "15.0.3-tuxcare.2", "purl": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:e6fe706d-0374-5d0a-aa17-102731784012", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.0.3-tuxcare.2 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:df09d642-48b8-5723-9fcb-f3e27e01a5c9", "id": "CVE-2025-66412", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 15.0.3-tuxcare.2 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c645f0a6-b23c-59d5-93c3-99a700c7ad68", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 15.0.3-tuxcare.2 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:960af707-a554-548e-b359-26f95086be25", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 15.0.3-tuxcare.2 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e94e203c-23bc-5c7d-95fa-b72e713e39e6", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 15.0.3-tuxcare.2 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5c1bcaa1-64c7-5a02-b567-9d76f0735208", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.0.3-tuxcare.2 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e329172f-d9ca-5ff3-a774-ab653b5249ed", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 15.0.3-tuxcare.2 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6f3cee30-3ed6-5c25-b240-8f1df3a1e9ae", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 15.0.3-tuxcare.2 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:99b82c49-d8c0-54b6-8c67-5831a3986e38", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.0.3-tuxcare.2 of @angular/service-worker. not_affected \u2014 Angular 15.0.3-tuxcare.1 is NOT affected by CVE-2026-50170. The HTTP TransferCache feature that is vulnerable in later Angular versions (v16+) does not exist in this version. The vulnerable code (transfer_cache.ts, hasAuthHeaders(), shouldCacheRequest(), withHttpTransferCache, provideClientHydration) is absent from Angular 15.0.3." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:26c4d588-1ee5-52d1-9ad5-789b92f13b88", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.0.3-tuxcare.2 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fdabba0c-70ca-5a6a-a293-38945720fcd2", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 15.0.3-tuxcare.2 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:02775773-93f3-55ba-9ead-b2a36848aeec", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.0.3-tuxcare.2 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0cc2fa04-e32d-5092-a30a-fcb17371130f", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.0.3-tuxcare.2 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:91cc16d1-51a0-5c40-a31a-dbd31369e3be", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 15.0.3-tuxcare.2 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fcf8f748-3c03-551d-9569-46796448130e", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 15.0.3-tuxcare.2 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:341906f8-ccfa-5480-807c-0f3cddaa2f95", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 15.0.3-tuxcare.2 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ded375d2-8265-5948-bbca-dfeac7cd388b", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.0.3-tuxcare.2 of @angular/service-worker. not_affected \u2014 Angular 15.0.3 is NOT AFFECTED by CVE-2026-54265. This version uses a different compiler architecture where two-way bindings desugar through the same code path as one-way bindings, both receiving identical security context resolution and sanitizer assignment. The vulnerable code (Ivy template pipeline with separate TwoWayProperty operation type) does not exist in this version." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4be535cf-d1db-5c22-8ae3-46a4753cf1ce", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.0.3-tuxcare.2 of @angular/service-worker. not_affected \u2014 Angular v15.0.3-tuxcare.1 is NOT affected by CVE-2026-54266. The vulnerable HttpTransferCache feature with weak DJB2 hash-based cache keys does not exist in this version. This feature was introduced in Angular v16+. The target has no code path from HTTP request handling to the vulnerability's cache poisoning goal." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5c062f1c-a5c1-529d-b727-af56a857fb14", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 15.0.3-tuxcare.2 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:396956d4-5934-5073-9573-3b70af014dc7", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.0.3-tuxcare.2 of @angular/service-worker." }, "affects": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/service-worker@15.0.3-tuxcare.2" } ] }