{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:472f90e2-5e27-5b86-9f72-9628d7f6a477", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/animations", "purl": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6", "version": "8.2.14-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:7629a474-429e-5d58-85af-64604c5c16cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 8.2.14-tuxcare.6 of @angular/animations." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:2b3ff457-8771-58fa-9258-5856a8110199", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 8.2.14-tuxcare.6 of @angular/animations, and is fixed in 8.2.14-tuxcare.10." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:6f4585ec-7859-5b74-8624-51ed8408b5fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.2.14-tuxcare.6 of @angular/animations." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:d6e62050-9632-59a6-ba20-891ba40dc981", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 8.2.14-tuxcare.6 of @angular/animations." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:9256487e-c7fb-539b-81c2-393037bc316e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 8.2.14-tuxcare.6 of @angular/animations." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:ec29f089-0461-5a74-9aba-b9b97cb56b98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 8.2.14-tuxcare.6 of @angular/animations, and is fixed in 8.2.14-tuxcare.8." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:7b5eda46-0646-5095-9e94-ef9fb798fda7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 8.2.14-tuxcare.6 of @angular/animations, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:6293bf8e-54c6-5756-8766-66a5457edde8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 8.2.14-tuxcare.6 of @angular/animations, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:ee85aa14-f8cb-5b30-b552-0318e57838f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 8.2.14-tuxcare.6 of @angular/animations, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:5ed67f31-60ff-5e99-8537-f10905a95f16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 8.2.14-tuxcare.6 of @angular/animations, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:fbbc87aa-3dcb-58a6-80bd-29f3a1c622f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 8.2.14-tuxcare.6 of @angular/animations, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:43982588-c625-5dfb-b364-f3d8499bf0d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 8.2.14-tuxcare.6 of @angular/animations, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:f39f4f70-856c-5721-9b44-d122744526ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 8.2.14-tuxcare.6 of @angular/animations, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:9fc46e4b-60a3-5f72-8c70-7804cb1c2b81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 8.2.14-tuxcare.6 of @angular/animations, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:02cb1426-0a7b-56a6-bb68-f78a4c7d7261", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 8.2.14-tuxcare.6 of @angular/animations, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:cd3e7590-53fe-5b7c-adfa-2fbf59c5427e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 8.2.14-tuxcare.6 of @angular/animations, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:b2a1b5d1-3604-511a-85f6-90521c651eec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 8.2.14-tuxcare.6 of @angular/animations, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:8ea7377c-073d-52e2-9210-628b38effff4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 8.2.14-tuxcare.6 of @angular/animations, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:7d6dc86f-6a58-5c72-bf4a-ce5abfdf84ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 8.2.14-tuxcare.6 of @angular/animations, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:6d2fac01-3a19-5bbf-9077-fd0139908897", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 8.2.14-tuxcare.6 of @angular/animations, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:9dabc214-e8e3-599c-8a3c-09f1ec852e83", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 8.2.14-tuxcare.6 of @angular/animations. not_affected \u2014 Angular 8.2.14 is NOT affected by CVE-2026-68945. The vulnerability exists in HttpTransferCache, a feature that automatically caches HTTP requests during SSR for client hydration. HttpTransferCache was introduced in Angular v16+ and does not exist in version 8.2.14. This version has only a manual TransferState key-value store with no automatic HttpClient integration, and no HTTP caching mechani...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:548fe8e9-4c17-5c9b-b380-92a551aaf02e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 8.2.14-tuxcare.6 of @angular/animations, and is fixed in 8.2.14-tuxcare.11." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:c00f51b1-95ee-542e-8593-42c888dd8552", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 8.2.14-tuxcare.6 of @angular/animations, and is fixed in 8.2.14-tuxcare.11." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:af660a49-88ea-5203-8f85-bc4de56ce48b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 8.2.14-tuxcare.6 of @angular/animations. not_affected \u2014 Angular 8.2.14 is NOT AFFECTED by CVE-2026-88056. The vulnerability requires a sophisticated URL resolution utility (`parseUrl` in `packages/platform-server/src/url.ts`) that calls `String.prototype.trim()` to strip Unicode whitespace, creating a discrepancy with WHATWG URL validation. This architecture was introduced in Angular v12+ (circa 2026 as TuxCare backports). Angular 8.2.14 (released N...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:ae56b0ae-b429-596f-b045-68343d93904c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 8.2.14-tuxcare.6 of @angular/animations." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:6029eaaa-2593-5e65-a5f4-b346a2620e96", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 8.2.14-tuxcare.6 of @angular/animations. not_affected \u2014 Angular v8.2.14 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, provideClientHydration(), and withRequestsMadeViaParent() \u2014 all features that do not exist in this version. These features were introduced in Angular v16 (per patches/CVE-2026-50170.patch and patches/CVE-2026-54266.patch). The target uses the legacy NgModule-based HttpClientModule without automatic ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ], "bom-ref": "urn:uuid:e173553e-d8a4-52f5-9063-4078b7c14f7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 8.2.14-tuxcare.6 of @angular/animations." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/animations@8.2.14-tuxcare.6" } ] }