{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c99a9b70-3922-5b30-b012-b45536fb4644", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/upgrade@15.0.3-tuxcare.2", "type": "library", "name": "@angular/upgrade", "version": "15.0.3-tuxcare.2", "purl": "pkg:npm/%40angular/upgrade@15.0.3-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:4a029f33-7e05-52f1-b399-1315280e9b73", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:09619cfa-b84b-5080-b5fa-d121603fdc75", "id": "CVE-2025-66412", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 15.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:72ac5c84-4bd2-5ffe-a858-841e9c78fe09", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 15.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:31729ccd-fc59-5fde-8198-e5a11e4d4024", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 15.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fb2d5d66-d126-5739-a8b5-43e695e894d8", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 15.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:85e2106d-a174-568d-9b21-5f15ea508684", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b6c5806c-acce-5f68-82dc-92f62dd19cc4", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 15.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:de7bd2ab-5c5b-5b0c-885d-60f002f73b87", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 15.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e77c3c47-08b8-5ba1-9657-820f177c4e56", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.0.3-tuxcare.2 of @angular/upgrade. not_affected \u2014 Angular 15.0.3-tuxcare.1 is NOT affected by CVE-2026-50170. The HTTP TransferCache feature that is vulnerable in later Angular versions (v16+) does not exist in this version. The vulnerable code (transfer_cache.ts, hasAuthHeaders(), shouldCacheRequest(), withHttpTransferCache, provideClientHydration) is absent from Angular 15.0.3." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:866b4827-4729-5d13-bc42-04d8a3d136e5", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:eb04d573-94d8-5587-9286-54a37706190f", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 15.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:dd594f98-bc8c-5b37-bcd1-6528b091940a", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e6b234b6-1cf0-5016-8d18-1d4872f7659e", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:109b5ef9-d621-54e1-964a-ee3b1fa149b4", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 15.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:34b270e3-da94-5b84-8ba2-e48cad87c1a5", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 15.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:243f647c-4e3a-59e4-a234-e06accda35c4", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 15.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2b750595-8df3-5cf5-8ad8-c5e7e80dbdde", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.0.3-tuxcare.2 of @angular/upgrade. not_affected \u2014 Angular 15.0.3 is NOT AFFECTED by CVE-2026-54265. This version uses a different compiler architecture where two-way bindings desugar through the same code path as one-way bindings, both receiving identical security context resolution and sanitizer assignment. The vulnerable code (Ivy template pipeline with separate TwoWayProperty operation type) does not exist in this version." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:67bddb68-1d94-5340-93a6-35e0a8ef7573", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.0.3-tuxcare.2 of @angular/upgrade. not_affected \u2014 Angular v15.0.3-tuxcare.1 is NOT affected by CVE-2026-54266. The vulnerable HttpTransferCache feature with weak DJB2 hash-based cache keys does not exist in this version. This feature was introduced in Angular v16+. The target has no code path from HTTP request handling to the vulnerability's cache poisoning goal." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:610cd633-a32e-51a3-b879-38d8120b6fc3", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 15.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:44816702-c428-510e-bf9e-d998b22571ad", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@15.0.3-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@15.0.3-tuxcare.2" } ] }