{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a2def706-772c-5aa1-b57e-3a489e73b28e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-browser-dynamic", "purl": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14", "version": "8.2.14-tuxcare.14", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:b37037be-3f62-5242-8ecd-77c975ec6048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:2661562a-16c3-55a7-a36c-3c89d1bd9a41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:659d422e-1b49-5e51-9420-373b72f388b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:26b6fa8e-4052-5304-b8c5-9c149327489d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:c26b0573-1aac-59c2-a83c-c5fcd0d3133d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:8594e3a2-612e-5a2a-8d30-a333bd1aa0ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:b11a99fc-430a-558d-bfef-fa9b1fbfd89d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:39c77f66-ddf5-5fae-837d-e283bee331de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:480d0336-9d0d-5e57-a107-535b1a256d95", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:4a27785d-803f-51a3-b20e-8c3eac0fb202", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:a4189d2e-1f81-5ffc-8e68-21492d82d4e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:a538aaae-8110-51e6-bad0-e1e2cc189f17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:9cab245a-3084-5e0c-a3e0-9100879b92ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:f33df27b-5586-5b91-8f30-685e83ce24f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:f198535a-b005-5f39-bd28-1a29b39ea42f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:88eff777-f2b4-5b25-a80b-25951744b136", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:9d48ec0e-1cc3-5f29-b0f3-fb1933cc4aa1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:4a09f80d-5f02-5981-8b22-d4d23548b6b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:02561261-f4aa-5293-9e05-87532531dd65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:078ee083-c3b8-5e6c-9306-f3cd6bb617ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:8bb9357a-e159-5d9d-ae8e-40a7049fbe82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:c0d37999-2c25-5105-a355-70a189807af6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:8c4b1156-bed9-53f6-8d15-171883edc9a2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 8.2.14 is NOT affected by CVE-2026-68945. The vulnerability exists in HttpTransferCache, a feature that automatically caches HTTP requests during SSR for client hydration. HttpTransferCache was introduced in Angular v16+ and does not exist in version 8.2.14. This version has only a manual TransferState key-value store with no automatic HttpClient integration, and no HTTP caching mechani...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:3e7fb475-7cdf-5492-aa70-420d46cd8f65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:f0c14ef1-f329-5bb4-8ef0-11114938c7e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:6d807533-8b49-5216-97a7-03da0ff49bb6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic. not_affected \u2014 Angular 8.2.14 is NOT AFFECTED by CVE-2026-88056. The vulnerability requires a sophisticated URL resolution utility (`parseUrl` in `packages/platform-server/src/url.ts`) that calls `String.prototype.trim()` to strip Unicode whitespace, creating a discrepancy with WHATWG URL validation. This architecture was introduced in Angular v12+ (circa 2026 as TuxCare backports). Angular 8.2.14 (released N...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:4327dcef-f110-5d0d-bf05-447628c5df69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:185dbcd8-0671-550c-ad9b-80da5cf7dcb1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:615a614f-e518-5194-91cd-2b97c7d46abe", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic. not_affected \u2014 Angular v8.2.14 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, provideClientHydration(), and withRequestsMadeViaParent() \u2014 all features that do not exist in this version. These features were introduced in Angular v16 (per patches/CVE-2026-50170.patch and patches/CVE-2026-54266.patch). The target uses the legacy NgModule-based HttpClientModule without automatic ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ], "bom-ref": "urn:uuid:54ef9add-28d7-5998-9231-81499c3ccee3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 8.2.14-tuxcare.14 of @angular/platform-browser-dynamic." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser-dynamic@8.2.14-tuxcare.14" } ] }