{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c91f736b-17fe-5487-9d7f-e526a517fb4a",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/%40angular/http@8.0.0-tuxcare.2",
      "type": "library",
      "name": "@angular/http",
      "version": "8.0.0-tuxcare.2",
      "purl": "pkg:npm/%40angular/http@8.0.0-tuxcare.2"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:0124453f-1810-5b05-b384-129433312ab9",
      "id": "CVE-2021-4231",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-4231 affects version 8.0.0-tuxcare.2 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@8.0.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4aca7284-b073-5054-bd5b-ce7593909bdb",
      "id": "CVE-2025-66035",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66035 is fixed in version 8.0.0-tuxcare.2 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@8.0.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:290d00f1-6645-57d3-9a2f-da38bcbc254a",
      "id": "CVE-2025-66412",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.0.0-tuxcare.2 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@8.0.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9b65aae0-95c1-5fe1-a664-19cc4fcbe127",
      "id": "CVE-2026-22610",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22610 affects version 8.0.0-tuxcare.2 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@8.0.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5c4da5f6-4d8b-515b-8070-939d377137f0",
      "id": "CVE-2026-27970",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-27970 affects version 8.0.0-tuxcare.2 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@8.0.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d25c25bf-259c-5323-bf29-387e17128a5c",
      "id": "CVE-2026-41423",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41423 does not affect version 8.0.0-tuxcare.2 of @angular/http. not_affected \u2014 The target Angular 8.0.0 is not affected by CVE-2026-41423. The vulnerability exists only in newer Angular versions (17+) that use the WHATWG URL API. The target uses Node.js url.parse() which does not interpret protocol-relative URLs (//evil.com) as hostname overrides when used without a base URL parameter."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@8.0.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bb40cbe5-5e10-5f86-bc1a-a7df8cf53e8b",
      "id": "CVE-2026-46417",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-46417 affects version 8.0.0-tuxcare.2 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@8.0.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2a4fd95a-1616-5e1f-bcce-db0fdce991d1",
      "id": "CVE-2026-50168",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50168 affects version 8.0.0-tuxcare.2 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@8.0.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:77270440-4664-50cf-b263-936fbde7c329",
      "id": "CVE-2026-50169",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50169 affects version 8.0.0-tuxcare.2 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@8.0.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b302d44e-b3e0-5d53-9eb6-a4f164890402",
      "id": "CVE-2026-50170",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-50170 does not affect version 8.0.0-tuxcare.2 of @angular/http. not_affected \u2014 Angular v8.0.0 is not affected by CVE-2026-50170. The vulnerability requires the HTTP TransferCache feature (automatic caching of HTTP responses during SSR with client hydration), which was introduced in Angular v16+. Version 8.0.0 lacks the vulnerable code path entirely: no transfer_cache.ts, no transferCacheInterceptorFn, no shouldCacheRequest() function, and no automatic HTTP response cachin..."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@8.0.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:52ef1234-e5af-5b4d-92c3-ebe8f0b76e72",
      "id": "CVE-2026-50171",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50171 affects version 8.0.0-tuxcare.2 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@8.0.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:afddeaec-d2ea-54fb-a8d9-2b19d8ac6b3b",
      "id": "CVE-2026-50184",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50184 affects version 8.0.0-tuxcare.2 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@8.0.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:652d651a-b2cf-5913-ae84-eb63b4f77219",
      "id": "CVE-2026-50555",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50555 affects version 8.0.0-tuxcare.2 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@8.0.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1bab8e50-bc84-56d7-abc8-951f57c27738",
      "id": "CVE-2026-50556",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50556 affects version 8.0.0-tuxcare.2 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@8.0.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:10b66717-ec04-5bfc-8bac-be1552617c4d",
      "id": "CVE-2026-50557",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50557 affects version 8.0.0-tuxcare.2 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@8.0.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bcb93a04-2dd5-5bb3-a179-277363b3972b",
      "id": "CVE-2026-52725",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-52725 affects version 8.0.0-tuxcare.2 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@8.0.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b2881614-5d7f-5e24-a14d-78612c0927b8",
      "id": "CVE-2026-54264",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54264 does not affect version 8.0.0-tuxcare.2 of @angular/http. not_affected \u2014 Target version 8.0.0-tuxcare.2 is NOT AFFECTED by CVE-2026-54264. The Service Worker implementation strips ALL request headers (including Authorization, Proxy-Authorization, and Cookie) when reconstructing network requests for asset fetches. This architectural design prevents sensitive headers from being forwarded to any destination, including cross-origin redirect targets."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@8.0.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b96ca2f3-d3b2-5cc5-a323-338fd376a626",
      "id": "CVE-2026-54265",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54265 does not affect version 8.0.0-tuxcare.2 of @angular/http. not_affected \u2014 Angular 8.0.0-tuxcare.2 is NOT affected by CVE-2026-54265. This vulnerability is specific to the Ivy template compiler pipeline introduced in Angular 9+. Angular 8.0.0 uses View Engine, which desugars two-way bindings through the same parsePropertyBinding() code path as one-way bindings, inherently applying schema-derived sanitization. The vulnerable TwoWayProperty operation and resolve_sanitiz..."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@8.0.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:88c0ef96-02ae-5a5c-8007-48ce410e9de9",
      "id": "CVE-2026-54266",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54266 does not affect version 8.0.0-tuxcare.2 of @angular/http. not_affected \u2014 Angular 8.0.0 does not contain the vulnerable HttpTransferCache feature. The CVE-2026-54266 vulnerability affects HttpTransferCache, which was introduced in Angular 9+. While this version has the underlying TransferState mechanism, it lacks the automatic HTTP request caching feature with the vulnerable DJB2 hash-based cache key generation."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@8.0.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:810ade9c-46a1-5f09-a760-5e31d7081019",
      "id": "CVE-2026-54267",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54267 affects version 8.0.0-tuxcare.2 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@8.0.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2f0890c3-fb29-5fa2-a4c9-4d8d6329894a",
      "id": "CVE-2026-54268",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54268 affects version 8.0.0-tuxcare.2 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@8.0.0-tuxcare.2"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/http@8.0.0-tuxcare.2"
    }
  ]
}