{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6290ca74-12ce-5d6b-8155-452e5cbbb999", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13", "type": "library", "name": "@angular/compiler", "version": "9.1.13-tuxcare.13", "purl": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:e4515e99-43a0-59e9-a28f-64476de458e5", "id": "CVE-2021-4231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 9.1.13-tuxcare.13 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:515a65eb-0912-5724-b9ad-34ff08499cf2", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 9.1.13-tuxcare.13 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:c5b569a8-71b1-5386-9244-5ce6cd578f3b", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 9.1.13-tuxcare.13 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:de9f9e4c-95b9-518d-a32e-c25d1e96c620", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 9.1.13-tuxcare.13 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:bdbb1427-a827-5d60-9bc5-c1721fc6ab3b", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 9.1.13-tuxcare.13 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:61551b8a-ce46-52e3-9d0b-e6edfebb00e0", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 9.1.13-tuxcare.13 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:2bcdba1a-5e29-5fd2-ac4b-2784a925e441", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 9.1.13-tuxcare.13 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:1286f80c-c002-5e04-9048-2b8335f005e6", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 9.1.13-tuxcare.13 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:116cc180-e567-5d80-a038-6dbf900bf14b", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 9.1.13-tuxcare.13 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:1dfe83f3-b7ad-584d-bcd9-618a99b87615", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 9.1.13-tuxcare.13 of @angular/compiler. not_affected \u2014 Angular v9.1.13 is not affected by CVE-2026-50170. The vulnerability exists in Angular's HttpTransferCache feature, which was introduced in Angular v16+. This feature does not exist in v9.1.13, making the vulnerability pattern impossible to manifest." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:07dd9a4e-e1f3-5980-995d-9dba80c45fe4", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 9.1.13-tuxcare.13 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:33d701f2-8b2c-5041-87d2-fb9cf7f5527b", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 9.1.13-tuxcare.13 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:4d299ded-8b29-5f81-9692-ce64f7e201d0", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 9.1.13-tuxcare.13 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:55c03055-c7ba-57b2-86be-b77b7d1c5744", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 9.1.13-tuxcare.13 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:2f50f3e9-8458-5b90-95b3-fb07607d3b25", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 9.1.13-tuxcare.13 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:472ee85f-2baf-520a-b2f6-46f3444c6dad", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 9.1.13-tuxcare.13 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:0b3f9563-d8de-5725-bf07-a59817079c4e", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 9.1.13-tuxcare.13 of @angular/compiler. not_affected \u2014 Angular 9.1.13 is not affected by CVE-2026-54264. The target repository uses a fundamentally different request reconstruction architecture than the vulnerable upstream versions (22.0+). The vulnerability requires the presence of header-copying logic during request reconstruction, which does not exist in this version." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:88994d3b-1f43-5bb1-af59-0b03de35f3b5", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 9.1.13-tuxcare.13 of @angular/compiler. not_affected \u2014 Angular 9.1.13-tuxcare.9 is NOT AFFECTED by CVE-2026-54265. The vulnerability exists in newer Ivy compiler's template/pipeline architecture where TwoWayProperty operations bypass sanitizer resolution. This version uses View Engine and early render3 (Ivy) implementations where two-way bindings desugar through the same parsePropertyBinding() path as one-way bindings, ensuring identical sanitizer ..." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:8695472b-df01-5471-895c-168bf379140e", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 9.1.13-tuxcare.13 of @angular/compiler. not_affected \u2014 Angular 9.1.13-tuxcare.9 does not contain the HttpTransferCache feature. The vulnerability CVE-2026-54266 affects the hash generation in HttpTransferCache, a feature introduced in Angular v16+. The target version (9.1.13) predates this feature by many major versions. While TransferState (generic state serialization) exists in v9, there is no HTTP caching integration that uses it. The packages/c..." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:22fd593a-ea0c-5a86-a00f-721967b77a8f", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 9.1.13-tuxcare.13 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:6e4560ff-30ba-5fd7-a333-0adb67fb6928", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 9.1.13-tuxcare.13 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:0216c2c8-f796-5a94-8c1d-160fee83161f", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 9.1.13-tuxcare.13 of @angular/compiler. not_affected \u2014 Angular v9.1.13 is not affected by CVE-2026-68945. The vulnerable HttpTransferCache feature was introduced in Angular v16.0.0 (March 2023), approximately 7 major versions after v9.1.13. The target version does not contain the HttpTransferCache code, the transfer_cache.ts file, or any automatic HTTP request caching mechanism that could exhibit the cache-key ambiguity vulnerability. While v9 does..." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:173ff102-3e71-559d-a605-ff5a79a656ca", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 9.1.13-tuxcare.13 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13" } ] }, { "bom-ref": "urn:uuid:7fb5bae9-fd62-5fb1-9631-570a20872c64", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 9.1.13-tuxcare.13 of @angular/compiler." }, "affects": [ { "ref": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler@9.1.13-tuxcare.13" } ] }