{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9a35ebb8-e160-59b4-8ec1-1e2f45d103bd", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/upgrade@8.0.3-tuxcare.2", "type": "library", "name": "@angular/upgrade", "version": "8.0.3-tuxcare.2", "purl": "pkg:npm/%40angular/upgrade@8.0.3-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:e21fdec6-19ff-59c6-b053-dbe059862d97", "id": "CVE-2021-4231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 8.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8287113b-dd60-5393-bbb3-a93d2054cad8", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 8.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d9dc8fdf-6c2b-5429-b827-68304977216a", "id": "CVE-2025-66412", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 8.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f3dbb6a2-1056-53a6-9172-8633a4819cc6", "id": "CVE-2026-22610", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 8.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1954eb6f-d347-5453-9629-a342712d0413", "id": "CVE-2026-27970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 8.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:86b248d8-ca0a-5fc7-bd16-dca762a626af", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 8.0.3-tuxcare.2 of @angular/upgrade. not_affected \u2014 The target Angular version 8.0.3 is not affected by CVE-2026-41423. The vulnerability requires WHATWG URL API (introduced in Angular 8.2.x+) to manifest the hostname override behavior. Version 8.0.3 uses Node.js legacy url.parse() which does not interpret protocol-relative URLs as having attacker-controlled hostnames." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0438b682-afec-58d5-84c5-9d250ae09da6", "id": "CVE-2026-46417", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 8.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:35ed504a-1949-5991-8dee-7fd23bf4cfc1", "id": "CVE-2026-50168", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 8.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:96edb29b-55ff-5baa-bf80-20851dd78e32", "id": "CVE-2026-50169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 8.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f0efe7b0-3c18-5ded-967c-4288100a077a", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 8.0.3-tuxcare.2 of @angular/upgrade. not_affected \u2014 The target Angular v8.0.3 is NOT affected by CVE-2026-50170. The vulnerability requires the HTTP transfer cache feature (packages/common/http/src/transfer_cache.ts) and client hydration mechanisms, which were introduced in Angular v16+. This version lacks the entire affected component." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e75eef46-e2c4-5361-9d0d-a46d239576a8", "id": "CVE-2026-50171", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 8.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d3aec65d-718a-5441-a090-5efe32ad9644", "id": "CVE-2026-50184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 8.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6be54991-2cab-5293-9c08-01690c8d0cbb", "id": "CVE-2026-50555", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 8.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7321df3a-b35b-5c18-8f24-fb2e8650da9c", "id": "CVE-2026-50556", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 8.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:62ef885b-2f37-57c8-b986-a4ff0e76022d", "id": "CVE-2026-50557", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 8.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:908270b4-c5db-522a-a263-153d1afcbf60", "id": "CVE-2026-52725", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 8.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d3c824e5-0c30-580e-a186-6d5db4230c2b", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 8.0.3-tuxcare.2 of @angular/upgrade. not_affected \u2014 The target Angular service-worker version 8.0.3-tuxcare.4 is NOT AFFECTED by CVE-2026-54264. The vulnerability requires the service worker to copy and forward request headers during cross-origin redirects. This version never copies headers: the AssetGroup path creates fresh requests from URLs only (no header preservation), and the DataGroup path delegates to the browser's spec-compliant fetch A..." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:678e2fbc-f91c-50cb-8471-66916b65b040", "id": "CVE-2026-54265", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 8.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6fd88efe-637a-5b76-80fb-1dc7bf93353a", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 8.0.3-tuxcare.2 of @angular/upgrade. not_affected \u2014 Angular 8.0.3-tuxcare.4 is NOT affected by CVE-2026-54266. The vulnerable HttpTransferCache feature with its weak DJB2 hash-based cache key generation does not exist in this version. HttpTransferCache was introduced in Angular v16+, while this target is v8.0.3." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cc654669-f4c4-5479-a268-a9b03c70625e", "id": "CVE-2026-54267", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 8.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:aee358ae-1c2e-5528-9c15-4d9cfd61a356", "id": "CVE-2026-54268", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 8.0.3-tuxcare.2 of @angular/upgrade." }, "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.0.3-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@8.0.3-tuxcare.2" } ] }