{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:aab3679e-525f-5c55-818f-0f8579cb8650", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/compiler", "purl": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14", "type": "library", "bom-ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14", "version": "8.2.14-tuxcare.14", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:92cb49b4-565a-59a0-a623-9b3a429f41da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:38289cce-e3f0-522c-a68c-94f66efc93a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:26c40fef-45bc-5626-8441-6ffb01eb0553", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:a0b00fbe-a4b4-5b1a-922b-d23d2bfb66a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:10d94c6c-33f2-5115-af33-5587c1aca3a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 8.2.14-tuxcare.14 of @angular/compiler." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:4dbb4402-7719-53b2-9b78-347eadb64d9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:055b59db-da67-59e9-8d0e-118f27db4fe6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:3871d808-6e50-569b-93e0-eca2c4d9c013", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:25e35cb5-a654-5f81-b3c9-78df31897d4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:7941b734-3066-5d87-886a-58707f7f7e0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:9288a401-8573-5a74-936b-6f490155d20c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:23b5703a-e85a-54fa-9c37-a0870ed44bad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:00f352ce-c61b-5b9f-aba2-9c53572b9911", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:01a9be7b-43a9-562a-b857-eeabd22e3fa2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:ea1afb4b-85fa-503a-b391-99df22a3d89d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:58c318ca-e332-51e5-8dcf-eb2e475ae64d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:0885072e-d85a-580d-99d2-f08ea5d865f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:97f32c70-8be5-5df8-bd7b-ea19b1cf3b87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:156887fd-14b4-58cf-9e0c-6d1e621f040d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:a0560451-1ff0-5dc7-b7d9-be86dfa7c953", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:1bb5a489-c591-5796-93e7-60e62021dd20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:217611d3-2193-5da4-b9aa-8073ab558792", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:ce036032-d921-523f-96a8-4a60f088dc11", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 8.2.14-tuxcare.14 of @angular/compiler. not_affected \u2014 Angular 8.2.14 is NOT affected by CVE-2026-68945. The vulnerability exists in HttpTransferCache, a feature that automatically caches HTTP requests during SSR for client hydration. HttpTransferCache was introduced in Angular v16+ and does not exist in version 8.2.14. This version has only a manual TransferState key-value store with no automatic HttpClient integration, and no HTTP caching mechani...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:a9f536b6-27e9-54c0-a74d-aebbc09bda24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:f76f4d26-a61f-552a-a50f-7384292dec65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:11241d74-10ac-5e1a-850d-30412437ef5f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 8.2.14-tuxcare.14 of @angular/compiler. not_affected \u2014 Angular 8.2.14 is NOT AFFECTED by CVE-2026-88056. The vulnerability requires a sophisticated URL resolution utility (`parseUrl` in `packages/platform-server/src/url.ts`) that calls `String.prototype.trim()` to strip Unicode whitespace, creating a discrepancy with WHATWG URL validation. This architecture was introduced in Angular v12+ (circa 2026 as TuxCare backports). Angular 8.2.14 (released N...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:e509042a-1bed-5d0c-bf8f-0516de49d9b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:34ee8009-69f2-5d39-b306-1d49c332d0d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:d81ff808-ee9d-5c05-83a2-d13f1468bf36", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 8.2.14-tuxcare.14 of @angular/compiler. not_affected \u2014 Angular v8.2.14 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, provideClientHydration(), and withRequestsMadeViaParent() \u2014 all features that do not exist in this version. These features were introduced in Angular v16 (per patches/CVE-2026-50170.patch and patches/CVE-2026-54266.patch). The target uses the legacy NgModule-based HttpClientModule without automatic ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:ecd3a4c7-0448-5f13-bdb4-be245f00ced4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 8.2.14-tuxcare.14 of @angular/compiler." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler@8.2.14-tuxcare.14" } ] }