{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ae268782-b6c6-5d4b-ba13-6f51bef2ed3c", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4", "type": "library", "name": "@angular/platform-browser", "version": "8.0.0-tuxcare.4", "purl": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:a3ef9eb9-307a-5862-b482-fb320550812b", "id": "CVE-2021-4231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 8.0.0-tuxcare.4 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:054bdeff-0d16-56a2-b6f9-f63d2c9d21d7", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 8.0.0-tuxcare.4 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:55b38ca3-e9f0-53a5-8ec0-459cea4898a3", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.0.0-tuxcare.4 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:33926684-44b6-5bfb-bedc-174e4961e067", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 8.0.0-tuxcare.4 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3993aed1-bfe1-5429-b625-b02071f6ef68", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 8.0.0-tuxcare.4 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1abd9401-9eb9-5edb-a2ac-9b87a1d48f97", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 8.0.0-tuxcare.4 of @angular/platform-browser. not_affected \u2014 The target Angular 8.0.0 is not affected by CVE-2026-41423. The vulnerability exists only in newer Angular versions (17+) that use the WHATWG URL API. The target uses Node.js url.parse() which does not interpret protocol-relative URLs (//evil.com) as hostname overrides when used without a base URL parameter." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4c94d1f9-8255-5dd2-9aaf-8bc820596a74", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 8.0.0-tuxcare.4 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:aec5a81b-1814-5748-83f3-8f2216f89b42", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 8.0.0-tuxcare.4 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3df746e9-e888-53fb-9b34-c3afb46000d4", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 8.0.0-tuxcare.4 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e85567cd-a7e3-5279-b86a-07295c241738", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 8.0.0-tuxcare.4 of @angular/platform-browser. not_affected \u2014 Angular v8.0.0 is not affected by CVE-2026-50170. The vulnerability requires the HTTP TransferCache feature (automatic caching of HTTP responses during SSR with client hydration), which was introduced in Angular v16+. Version 8.0.0 lacks the vulnerable code path entirely: no transfer_cache.ts, no transferCacheInterceptorFn, no shouldCacheRequest() function, and no automatic HTTP response cachin..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d29e33d3-af59-5528-9bdd-e7e6e1fecb14", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 8.0.0-tuxcare.4 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:53bce52a-e234-5858-9d0c-5755b86ca136", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 8.0.0-tuxcare.4 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f6acfb06-5d3b-5cbf-b814-ff5a40a189c9", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 8.0.0-tuxcare.4 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6422d2f7-9b00-503d-88de-bf23209e9e2a", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 8.0.0-tuxcare.4 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2866f3f8-4e9a-578d-946a-e1e832ba9cdf", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 8.0.0-tuxcare.4 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:cac5b925-5214-5170-822f-6e3c09ff15d4", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 8.0.0-tuxcare.4 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6234c7dc-2863-5afe-b29d-7123b70ba879", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 8.0.0-tuxcare.4 of @angular/platform-browser. not_affected \u2014 Target version 8.0.0-tuxcare.2 is NOT AFFECTED by CVE-2026-54264. The Service Worker implementation strips ALL request headers (including Authorization, Proxy-Authorization, and Cookie) when reconstructing network requests for asset fetches. This architectural design prevents sensitive headers from being forwarded to any destination, including cross-origin redirect targets." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3d8e1012-b7ae-5742-8878-abbe22e1b2b6", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 8.0.0-tuxcare.4 of @angular/platform-browser. not_affected \u2014 Angular 8.0.0-tuxcare.2 is NOT affected by CVE-2026-54265. This vulnerability is specific to the Ivy template compiler pipeline introduced in Angular 9+. Angular 8.0.0 uses View Engine, which desugars two-way bindings through the same parsePropertyBinding() code path as one-way bindings, inherently applying schema-derived sanitization. The vulnerable TwoWayProperty operation and resolve_sanitiz..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:27c3631d-8a8e-5d36-9500-8698faffc530", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 8.0.0-tuxcare.4 of @angular/platform-browser. not_affected \u2014 Angular 8.0.0 does not contain the vulnerable HttpTransferCache feature. The CVE-2026-54266 vulnerability affects HttpTransferCache, which was introduced in Angular 9+. While this version has the underlying TransferState mechanism, it lacks the automatic HTTP request caching feature with the vulnerable DJB2 hash-based cache key generation." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:40756eae-39ea-50f3-87bd-2cba262d4cfa", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 8.0.0-tuxcare.4 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:da51cb6d-d3fd-5c23-b411-0d70aff91abd", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 8.0.0-tuxcare.4 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ac42f957-9c9f-521b-be2d-debcc2a5806f", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 8.0.0-tuxcare.4 of @angular/platform-browser. not_affected \u2014 Angular v8.0.0 is NOT AFFECTED by CVE-2026-68945. The vulnerability concerns HttpTransferCache's cache-key generation creating collisions when HTTP request parameters use repeated keys vs scalar comma-separated values. However, HttpTransferCache does not exist in v8.0.0 \u2014 it was introduced in Angular v16. This version only has the manual TransferState API (a simple key-value store), with no aut..." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8442df35-8f3d-5866-ae3c-2e4c365e146b", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 8.0.0-tuxcare.4 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e05336ae-daf1-56f7-95b5-afa937728b37", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 8.0.0-tuxcare.4 of @angular/platform-browser." }, "affects": [ { "ref": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-browser@8.0.0-tuxcare.4" } ] }