{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2809b721-857a-5478-9609-dbf7988d5eaf", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/compiler-cli", "purl": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14", "type": "library", "bom-ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14", "version": "8.2.14-tuxcare.14", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:0e9a7152-9085-5fac-b2ef-9bef7e6cc0d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler-cli." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:45346d52-7392-569e-ace6-eecb1a9f0126", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler-cli." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:46815a66-b3d1-5f3c-9289-1a513ebc3246", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler-cli." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:eb54118a-1803-5c1c-8c14-76302427474f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler-cli." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:2679e92b-1130-54c9-b9ec-75d96a5a2fb3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 8.2.14-tuxcare.14 of @angular/compiler-cli." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:a1c947ac-5593-5a20-852c-c4a118174e3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler-cli." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:acdc434d-5fdf-5552-aa6d-04170d6d8b16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler-cli." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:b441426c-aec0-5f48-a7e0-e3a46f6d914a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler-cli." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:325789a3-bc67-56f2-878c-c218c4c6e9e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler-cli." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:0b82816b-a9dd-5552-92ad-9af0461796e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler-cli." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:f866d003-c46c-50cf-af33-6e9d93e6bb6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler-cli." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:a65b303f-0254-52ab-91c6-86d82c7565e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler-cli." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:6abdcf7f-7861-511d-96bb-1cd3cc81c5cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler-cli." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:f36439fe-fc74-50de-beab-2fdd490cc21d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler-cli." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:8887c23a-53b4-5a59-b830-7927956d2c23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler-cli." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:e863e57a-0485-536d-9ef2-367cc3df3ff3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler-cli." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:4b52e169-e0a1-56ec-b8ea-4a98a6594468", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler-cli." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:ebd1be75-c1fe-5970-ad54-d26268c91cf9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler-cli." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:19131794-a97a-559f-a943-66314d7927a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler-cli." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:32a65aa2-88f1-5949-9510-cf5ae2fd5d9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler-cli." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:313c86f1-1f5c-5e0b-8245-b88e86dd2b61", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler-cli." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:04a7d4b9-10dc-5f63-8dca-44179619db2a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler-cli." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:3f134d8f-f358-54cf-8653-118bd6816206", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 8.2.14-tuxcare.14 of @angular/compiler-cli. not_affected \u2014 Angular 8.2.14 is NOT affected by CVE-2026-68945. The vulnerability exists in HttpTransferCache, a feature that automatically caches HTTP requests during SSR for client hydration. HttpTransferCache was introduced in Angular v16+ and does not exist in version 8.2.14. This version has only a manual TransferState key-value store with no automatic HttpClient integration, and no HTTP caching mechani...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:01ae8fd8-bf85-5c21-ab5f-a26d96440203", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler-cli." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:0420b552-b26f-5709-a24c-9209751b4847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler-cli." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:1c418253-a94a-5711-84f4-1a0d01eb6f1b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 8.2.14-tuxcare.14 of @angular/compiler-cli. not_affected \u2014 Angular 8.2.14 is NOT AFFECTED by CVE-2026-88056. The vulnerability requires a sophisticated URL resolution utility (`parseUrl` in `packages/platform-server/src/url.ts`) that calls `String.prototype.trim()` to strip Unicode whitespace, creating a discrepancy with WHATWG URL validation. This architecture was introduced in Angular v12+ (circa 2026 as TuxCare backports). Angular 8.2.14 (released N...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:cee9b26b-8cdf-5c2b-a87d-58ee56616d6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler-cli." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:c46a028e-9ea4-5159-b975-fc83208a4057", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler-cli." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:9e0cea9d-5e74-58ec-8e9f-ebdb9481e3a8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 8.2.14-tuxcare.14 of @angular/compiler-cli. not_affected \u2014 Angular v8.2.14 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, provideClientHydration(), and withRequestsMadeViaParent() \u2014 all features that do not exist in this version. These features were introduced in Angular v16 (per patches/CVE-2026-50170.patch and patches/CVE-2026-54266.patch). The target uses the legacy NgModule-based HttpClientModule without automatic ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:bdce25e8-1721-5e8d-884d-30bda9a8bf42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler-cli." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.14" } ] }