{
  "@id": "urn:uuid:0c8367f3-235d-4482-b815-b0386f8c3497",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T16:18:05.828019+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@13.3.0",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@13.3.0"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2025-66035 affects version 13.3.0 of @angular/common, and is fixed in 13.3.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2025-66035"
      },
      "action_statement": "Vulnerability CVE-2025-66035 affects version 13.3.0 of @angular/common, and is fixed in 13.3.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@13.3.0",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@13.3.0"
          }
        }
      ],
      "timestamp": "2026-10-20T20:46:00.144564+00:00",
      "status_notes": "Vulnerability CVE-2026-111753 affects version 13.3.0 of @angular/common.",
      "vulnerability": {
        "name": "CVE-2026-111753"
      },
      "action_statement": "Vulnerability CVE-2026-111753 affects version 13.3.0 of @angular/common."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@13.3.0",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@13.3.0"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2026-50170 does not affect version 13.3.0 of @angular/common. not_affected \u2014 Angular v13.3.0 is not affected by CVE-2026-50170. The vulnerable component (HttpTransferCache) does not exist in this version. The HttpTransferCache feature and automatic HTTP response caching during SSR were introduced in Angular v16+, while this target is v13.3.0-tuxcare.1.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50170"
      },
      "impact_statement": "not_affected \u2014 Angular v13.3.0 is not affected by CVE-2026-50170. The vulnerable component (HttpTransferCache) does not exist in this version. The HttpTransferCache feature and automatic HTTP response caching during SSR were introduced in Angular v16+, while this target is v13.3.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@13.3.0",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@13.3.0"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2026-50171 affects version 13.3.0 of @angular/common, and is fixed in 13.3.0-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-50171"
      },
      "action_statement": "Vulnerability CVE-2026-50171 affects version 13.3.0 of @angular/common, and is fixed in 13.3.0-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@13.3.0",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@13.3.0"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2026-54266 does not affect version 13.3.0 of @angular/common. not_affected \u2014 Angular 13.3.0 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature with weak DJB2 hash-based cache key generation does not exist in this version. HttpTransferCache was introduced in Angular v16+, and version 13.3.0 predates this feature.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54266"
      },
      "impact_statement": "not_affected \u2014 Angular 13.3.0 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature with weak DJB2 hash-based cache key generation does not exist in this version. HttpTransferCache was introduced in Angular v16+, and version 13.3.0 predates this feature."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@13.3.0",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@13.3.0"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2026-54268 affects version 13.3.0 of @angular/common, and is fixed in 13.3.0-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-54268"
      },
      "action_statement": "Vulnerability CVE-2026-54268 affects version 13.3.0 of @angular/common, and is fixed in 13.3.0-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@13.3.0",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@13.3.0"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2026-68945 does not affect version 13.3.0 of @angular/common. not_affected \u2014 Angular v13.3.0 is NOT AFFECTED by CVE-2026-68945. The vulnerable HttpTransferCache feature does not exist in this version\u2014it was introduced in Angular v16.0.0. The cache-key collision vulnerability requires the HttpTransferCache's sortAndConcatParams() function in transfer_cache.ts, which is absent from v13. Verified by filesystem inspection, git history, and existing patch documentation (CVE-...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-68945"
      },
      "impact_statement": "not_affected \u2014 Angular v13.3.0 is NOT AFFECTED by CVE-2026-68945. The vulnerable HttpTransferCache feature does not exist in this version\u2014it was introduced in Angular v16.0.0. The cache-key collision vulnerability requires the HttpTransferCache's sortAndConcatParams() function in transfer_cache.ts, which is absent from v13. Verified by filesystem inspection, git history, and existing patch documentation (CVE-..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/common@13.3.0",
          "identifiers": {
            "purl": "pkg:npm/%40angular/common@13.3.0"
          }
        }
      ],
      "timestamp": "2026-10-17T23:48:00.148285+00:00",
      "status_notes": "Vulnerability CVE-2026-88059 does not affect version 13.3.0 of @angular/common. not_affected \u2014 Angular 13.3.0 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation via withRequestsMadeViaParent(), features introduced in Angular v16.0.0 (September 2022), six months after Angular 13.3.0 was released (March 2022). The vulnerable code paths, files (provider.ts, transfer_cache.ts), and APIs (provideHttpClient, withRequestsMadeV...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-88059"
      },
      "impact_statement": "not_affected \u2014 Angular 13.3.0 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation via withRequestsMadeViaParent(), features introduced in Angular v16.0.0 (September 2022), six months after Angular 13.3.0 was released (March 2022). The vulnerable code paths, files (provider.ts, transfer_cache.ts), and APIs (provideHttpClient, withRequestsMadeV..."
    }
  ]
}