{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6f2d8e0b-6818-5c3a-b2c1-c75826b5f618", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/platform-server@15.2.6-tuxcare.2", "type": "library", "name": "@angular/platform-server", "version": "15.2.6-tuxcare.2", "purl": "pkg:npm/%40angular/platform-server@15.2.6-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:a087c3e9-8cb2-5e46-b7d4-630fca82ee87", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.2.6-tuxcare.2 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:00ab9ebc-0210-5663-8a25-625737862da0", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 15.2.6-tuxcare.2 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2f50db7c-1788-5d86-aa3e-e109f45d4229", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 15.2.6-tuxcare.2 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0deb1b7d-3d10-5f53-8a6c-ddcce09e8fb2", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 15.2.6-tuxcare.2 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a231fcc4-452a-5e6d-a80e-df311349f099", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.6-tuxcare.2 of @angular/platform-server. not_affected \u2014 Target version 15.2.6 is NOT affected by CVE-2026-41423. The target uses Node.js legacy url.parse() API which does NOT interpret protocol-relative URLs (//evil.com) as hostname overrides. The vulnerability only exists when using the WHATWG URL API (new URL()) without input preprocessing, which this version does not use. Testing confirms url.parse('//attacker.com') sets hostname to null (not 'at..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3317b438-6818-50d2-9e51-c3cf6f4f7975", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.2.6-tuxcare.2 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cd8eca4f-bd8b-5d04-ba05-207350447dce", "id": "CVE-2026-50168", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50168 does not affect version 15.2.6-tuxcare.2 of @angular/platform-server. not_affected \u2014 CVE-2026-50168 targets a vulnerability in Angular's platform-server allowedHosts validation feature that allows bypassing hostname restrictions via malformed URLs (e.g., evil.com:80:80). The target repository (Angular v15.2.6-tuxcare.1) does not contain the allowedHosts feature (validateAllowedHosts, isHostAllowed functions) that this CVE exploits. Without the allowedHosts validation mechanism,..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6a7bd352-57ba-5f0d-a6e5-0f17f30c4f73", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 15.2.6-tuxcare.2 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e535008e-e56a-592d-a607-401a863895fa", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.6-tuxcare.2 of @angular/platform-server. not_affected \u2014 Angular version 15.2.6-tuxcare.1 does not contain the HttpTransferCache feature that is the subject of CVE-2026-50170. The vulnerable component (packages/common/http/src/transfer_cache.ts) was introduced in Angular v16.0.0-next.7, after the target version. The vulnerability requires automatic HTTP response caching in TransferState during SSR, which does not exist in v15.2.6." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6c86f31d-303d-5467-9256-b1c2271fac90", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.2.6-tuxcare.2 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ed589628-9e70-5c6d-b05c-70b3d5f45488", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 15.2.6-tuxcare.2 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:396f0721-abac-5bf2-8605-80cd008c706d", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.2.6-tuxcare.2 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e94ceba9-1953-5abe-abfe-89c1b0393d00", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.2.6-tuxcare.2 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1fcf5d5d-237d-58c2-acca-8af2e22844a7", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 15.2.6-tuxcare.2 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e0eca198-74d8-5eed-a9e5-544b72628bb5", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 15.2.6-tuxcare.2 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fca58e8c-0667-5e33-a5ce-28fab5601287", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 15.2.6-tuxcare.2 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e017516b-e913-5350-b012-da99e7c76809", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.2.6-tuxcare.2 of @angular/platform-server. not_affected \u2014 Angular 15.2.6 is not affected by CVE-2026-54265. The vulnerability is specific to the template pipeline architecture introduced in Angular 20+, which does not exist in Angular 15. Angular 15 uses the older render3 compiler that desugars two-way bindings into standard property bindings at parse time, and these property bindings correctly receive sanitizers." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:555a2589-d2af-58bb-818e-30151cd02664", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.6-tuxcare.2 of @angular/platform-server. not_affected \u2014 Angular 15.2.6-tuxcare.1 is not affected by CVE-2026-54266 because the HttpTransferCache feature, including the vulnerable weak DJB2 hash function, was not introduced until Angular v16.0.0. The target version predates the introduction of this feature entirely." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8a072356-f823-5c8c-a7f8-f0c9a312fcd8", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 15.2.6-tuxcare.2 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5a7dfcc8-9ab4-5174-9c26-30b4859214e3", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.2.6-tuxcare.2 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:11774b74-c233-58c5-90a3-324bf8156b3b", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 15.2.6-tuxcare.2 of @angular/platform-server. not_affected \u2014 Angular 15.2.6 is not affected by CVE-2026-68945. The vulnerable HttpTransferCache feature does not exist in this version. HttpTransferCache was introduced in Angular v16.0.0 (commit aff1512950, March 31, 2023) and first released on May 3, 2023. The target version 15.2.6 was released on April 5, 2023 and predates the feature. Verified by: (1) git ancestry check confirms the feature commit is NO..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1006cad8-a8d0-5d62-a73a-cf5b120b285f", "id": "CVE-2026-69149", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 15.2.6-tuxcare.2 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.6-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:687689a7-28dd-5d99-960d-7400174678c4", "id": "CVE-2026-69151", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 15.2.6-tuxcare.2 of @angular/platform-server." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.6-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@15.2.6-tuxcare.2" } ] }