{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6b903fb3-6ba7-5836-ae5b-d2d6410fbd48", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/common", "purl": "pkg:npm/%40angular/common@8.2.14-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5", "version": "8.2.14-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:dd7e04e0-081a-5cd6-a531-b6269e9d9f2a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 8.2.14-tuxcare.5 of @angular/common." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:08c40110-a45e-5e91-a3f0-f732b10339ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 8.2.14-tuxcare.5 of @angular/common, and is fixed in 8.2.14-tuxcare.10." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:9e9f2eed-6cdf-571f-b67f-2058954ffccb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.2.14-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:7bfa6d86-abd0-5a1b-b67b-8caace81157f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 8.2.14-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:0372853b-dfaf-5d1b-9f5a-dbd90333eb18", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 8.2.14-tuxcare.5 of @angular/common, and is fixed in 8.2.14-tuxcare.6." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:df8dd0f8-9a3d-5a78-977b-58d89b2bf4a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 8.2.14-tuxcare.5 of @angular/common, and is fixed in 8.2.14-tuxcare.8." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:e3a2b0c2-aae4-595f-ab4b-d014904d6b6c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 8.2.14-tuxcare.5 of @angular/common, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:91125549-48b8-5b4a-a78f-5952a35065f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 8.2.14-tuxcare.5 of @angular/common, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:39ba95cc-4537-519c-b8ed-020ac1717463", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 8.2.14-tuxcare.5 of @angular/common, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:b1e414ba-2854-5ad1-a485-0ec1c695ea4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 8.2.14-tuxcare.5 of @angular/common, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:0476f3a4-be9d-55a2-a559-0bc3dd91aca3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 8.2.14-tuxcare.5 of @angular/common, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:b2b3d208-9791-5d21-a7c4-1a2a23a2c180", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 8.2.14-tuxcare.5 of @angular/common, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:18effab7-ef9a-51c4-b83f-5dcb1aa35c85", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 8.2.14-tuxcare.5 of @angular/common, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:b788576b-4572-5754-a23d-f1c29f14a757", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 8.2.14-tuxcare.5 of @angular/common, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:24ffb1b8-7188-505a-be8e-34926a0186dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 8.2.14-tuxcare.5 of @angular/common, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:6c8f7d90-47ed-5bb6-ad89-949d745b7232", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 8.2.14-tuxcare.5 of @angular/common, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:f9139084-9c5d-56ed-87db-1eedbc63fa84", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 8.2.14-tuxcare.5 of @angular/common, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:1e43f6bc-25d5-5f5a-8d0c-36e94bee2a22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 8.2.14-tuxcare.5 of @angular/common, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:686a87ee-97b2-55e2-a4c5-a71da90f6787", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 8.2.14-tuxcare.5 of @angular/common, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:990ea922-1f72-5363-a78b-641cc3292fc7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 8.2.14-tuxcare.5 of @angular/common, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:2a7f302f-014c-5125-a0ce-528f7ae3b402", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 8.2.14-tuxcare.5 of @angular/common. not_affected \u2014 Angular 8.2.14 is NOT affected by CVE-2026-68945. The vulnerability exists in HttpTransferCache, a feature that automatically caches HTTP requests during SSR for client hydration. HttpTransferCache was introduced in Angular v16+ and does not exist in version 8.2.14. This version has only a manual TransferState key-value store with no automatic HttpClient integration, and no HTTP caching mechani...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:d115dd96-39ef-5b78-8aa9-f003c39a366d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 8.2.14-tuxcare.5 of @angular/common, and is fixed in 8.2.14-tuxcare.11." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:8244344e-4cb6-5e06-9a05-31e41938dfde", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 8.2.14-tuxcare.5 of @angular/common, and is fixed in 8.2.14-tuxcare.11." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:3e2c00ee-9704-53ad-8c8c-8b783407b668", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 8.2.14-tuxcare.5 of @angular/common. not_affected \u2014 Angular 8.2.14 is NOT AFFECTED by CVE-2026-88056. The vulnerability requires a sophisticated URL resolution utility (`parseUrl` in `packages/platform-server/src/url.ts`) that calls `String.prototype.trim()` to strip Unicode whitespace, creating a discrepancy with WHATWG URL validation. This architecture was introduced in Angular v12+ (circa 2026 as TuxCare backports). Angular 8.2.14 (released N...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:8c2980f6-f434-5ef1-af94-0069f2d303b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 8.2.14-tuxcare.5 of @angular/common." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:5b6ba883-cafb-5cd1-a7a0-2b7378c9691a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 8.2.14-tuxcare.5 of @angular/common. not_affected \u2014 Angular v8.2.14 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, provideClientHydration(), and withRequestsMadeViaParent() \u2014 all features that do not exist in this version. These features were introduced in Angular v16 (per patches/CVE-2026-50170.patch and patches/CVE-2026-54266.patch). The target uses the legacy NgModule-based HttpClientModule without automatic ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ], "bom-ref": "urn:uuid:bbbbc48e-d991-5d18-9255-21c17f602442", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 8.2.14-tuxcare.5 of @angular/common." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/common@8.2.14-tuxcare.5" } ] }