{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c2b4fd70-5804-56ae-9a55-c30addf575fe", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/compiler-cli", "purl": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9", "type": "library", "bom-ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9", "version": "8.2.14-tuxcare.9", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:7b9ed125-17e1-580a-ae6a-1106ae4f14b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 8.2.14-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:d63a2de6-0e92-5a12-b1be-2b12890d8051", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 8.2.14-tuxcare.9 of @angular/compiler-cli, and is fixed in 8.2.14-tuxcare.10." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:9aee1727-d9b5-500f-bd97-b1dd63eca7b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.2.14-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:81e8658d-9cc1-53ef-81f8-53a9750120be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 8.2.14-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:98018316-93f4-56b1-952b-8d79b8e78199", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 8.2.14-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:98054e21-bf0d-59fe-9950-a6cf4024287d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 8.2.14-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:9e7de20d-4f0c-5f07-9134-5375a420bb1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 8.2.14-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:1e931a0c-f48c-5aa2-9da3-b6705458ce4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 8.2.14-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:1e9d78e3-15c9-5ee9-9cfd-c69c4dc34357", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 8.2.14-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:34899704-eb3d-5d2c-9cd5-037864058b03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 8.2.14-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:63b033fe-1453-5b1a-9cb1-4f6c606d777d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 8.2.14-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:94fceab5-46f7-56cb-8168-0be11ce98451", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 8.2.14-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:7e6233b9-548d-56ed-9df4-d92d894ed154", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 8.2.14-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:0fdd80e2-a58a-58ff-a3d5-2ef7597a1d3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 8.2.14-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:a3c8baf0-f91d-5f69-bdfe-1f7cc5e902d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 8.2.14-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:980f2491-ddea-5a87-84d6-028070ec0619", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 8.2.14-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:10e60877-3213-5a83-ba66-b9221610e24f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 8.2.14-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:b7df23a1-9c2f-5773-ae36-5c1ea056ffe9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 8.2.14-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:fdf336b1-c643-5560-9c38-32366da997bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 8.2.14-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:3faa77bc-14e3-58db-9ea1-5b3430d96204", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 8.2.14-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:50ccb112-1f06-5bc0-9e15-65e53202515a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 8.2.14-tuxcare.9 of @angular/compiler-cli. not_affected \u2014 Angular 8.2.14 is NOT affected by CVE-2026-68945. The vulnerability exists in HttpTransferCache, a feature that automatically caches HTTP requests during SSR for client hydration. HttpTransferCache was introduced in Angular v16+ and does not exist in version 8.2.14. This version has only a manual TransferState key-value store with no automatic HttpClient integration, and no HTTP caching mechani...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:12739fd3-8151-5743-b07f-6f7e656e2da3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 8.2.14-tuxcare.9 of @angular/compiler-cli, and is fixed in 8.2.14-tuxcare.11." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:470509c6-f8ed-59e5-9a6d-db16489b0718", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 8.2.14-tuxcare.9 of @angular/compiler-cli, and is fixed in 8.2.14-tuxcare.11." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:7c96356d-629b-59ef-8417-929988f7fbba", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 8.2.14-tuxcare.9 of @angular/compiler-cli. not_affected \u2014 Angular 8.2.14 is NOT AFFECTED by CVE-2026-88056. The vulnerability requires a sophisticated URL resolution utility (`parseUrl` in `packages/platform-server/src/url.ts`) that calls `String.prototype.trim()` to strip Unicode whitespace, creating a discrepancy with WHATWG URL validation. This architecture was introduced in Angular v12+ (circa 2026 as TuxCare backports). Angular 8.2.14 (released N...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:203c2ec3-7886-5d50-8fe3-3436c5e77fde", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 8.2.14-tuxcare.9 of @angular/compiler-cli." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:ac45f92c-23c9-50d0-87f5-6aa00bf6bd17", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 8.2.14-tuxcare.9 of @angular/compiler-cli. not_affected \u2014 Angular v8.2.14 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, provideClientHydration(), and withRequestsMadeViaParent() \u2014 all features that do not exist in this version. These features were introduced in Angular v16 (per patches/CVE-2026-50170.patch and patches/CVE-2026-54266.patch). The target uses the legacy NgModule-based HttpClientModule without automatic ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:10720a76-3653-5ec0-9bd1-d9b654c3ab36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 8.2.14-tuxcare.9 of @angular/compiler-cli." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.9" } ] }