{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6fb1535d-d502-5f01-a3a2-29de248ceea0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-webworker", "purl": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7", "version": "8.2.14-tuxcare.7", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:1a7d69a9-f615-557d-9427-10fe0a335bf8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 8.2.14-tuxcare.7 of @angular/platform-webworker." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:018b74a5-6b4e-529c-8a81-5597dae13809", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 8.2.14-tuxcare.7 of @angular/platform-webworker, and is fixed in 8.2.14-tuxcare.10." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:4f6ecc2d-b00f-5414-8696-8e5d5133098a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.2.14-tuxcare.7 of @angular/platform-webworker." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:51e894df-8049-5945-a5a4-0538e6802a48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 8.2.14-tuxcare.7 of @angular/platform-webworker." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:2d94a0bd-e06c-5d2a-bd59-41da7b805f07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 8.2.14-tuxcare.7 of @angular/platform-webworker." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:e9baa096-01b2-5a58-a56d-573ef5e72ffb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 8.2.14-tuxcare.7 of @angular/platform-webworker, and is fixed in 8.2.14-tuxcare.8." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:7b283b9f-01b2-53fb-a335-4cb689037b36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 8.2.14-tuxcare.7 of @angular/platform-webworker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:661fb2d8-784c-507e-a5d5-71c9ef748500", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 8.2.14-tuxcare.7 of @angular/platform-webworker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:b85b7fde-8c06-579f-94c5-0bc965882ab1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 8.2.14-tuxcare.7 of @angular/platform-webworker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:a971f040-2f0d-56ce-bbf7-946953fbd4fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 8.2.14-tuxcare.7 of @angular/platform-webworker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:d7055e1e-5435-5012-8b8b-77268d86987b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 8.2.14-tuxcare.7 of @angular/platform-webworker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:de5bd67b-063d-5026-b914-737cd78ebee0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 8.2.14-tuxcare.7 of @angular/platform-webworker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:58567b02-2f9e-5c43-9248-9a302f9d8960", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 8.2.14-tuxcare.7 of @angular/platform-webworker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:523911e3-ec04-5805-9b5a-382ddad378cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 8.2.14-tuxcare.7 of @angular/platform-webworker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:384b4ea8-1269-5659-96ac-a9938e7cd4e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 8.2.14-tuxcare.7 of @angular/platform-webworker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:1622c191-c1c2-590b-85b8-6b58313659b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 8.2.14-tuxcare.7 of @angular/platform-webworker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:cf5fcd8f-321a-5d67-8177-f9b1292de6e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 8.2.14-tuxcare.7 of @angular/platform-webworker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:872cfdab-df84-55bd-b5a5-b92d4119bc7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 8.2.14-tuxcare.7 of @angular/platform-webworker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:ac490711-57fa-551c-8be3-1c0cb26589f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 8.2.14-tuxcare.7 of @angular/platform-webworker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:cc0748bb-9d21-5632-a053-1b0349a6d968", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 8.2.14-tuxcare.7 of @angular/platform-webworker, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:e3b41efa-e6af-5643-be0c-ed03c7785242", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 8.2.14-tuxcare.7 of @angular/platform-webworker. not_affected \u2014 Angular 8.2.14 is NOT affected by CVE-2026-68945. The vulnerability exists in HttpTransferCache, a feature that automatically caches HTTP requests during SSR for client hydration. HttpTransferCache was introduced in Angular v16+ and does not exist in version 8.2.14. This version has only a manual TransferState key-value store with no automatic HttpClient integration, and no HTTP caching mechani...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:4e2d083b-f553-5eb3-81cf-61901474b406", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 8.2.14-tuxcare.7 of @angular/platform-webworker, and is fixed in 8.2.14-tuxcare.11." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:1bc4b970-0752-5a83-8088-c7b5d02f5ddd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 8.2.14-tuxcare.7 of @angular/platform-webworker, and is fixed in 8.2.14-tuxcare.11." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:b154fa88-7092-5350-9930-1131ca00a1fa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 8.2.14-tuxcare.7 of @angular/platform-webworker. not_affected \u2014 Angular 8.2.14 is NOT AFFECTED by CVE-2026-88056. The vulnerability requires a sophisticated URL resolution utility (`parseUrl` in `packages/platform-server/src/url.ts`) that calls `String.prototype.trim()` to strip Unicode whitespace, creating a discrepancy with WHATWG URL validation. This architecture was introduced in Angular v12+ (circa 2026 as TuxCare backports). Angular 8.2.14 (released N...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:66fd057e-8a54-5548-97cc-da8e77aa835d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 8.2.14-tuxcare.7 of @angular/platform-webworker." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:001e084b-1838-5672-b4c8-9c8fddd250b7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 8.2.14-tuxcare.7 of @angular/platform-webworker. not_affected \u2014 Angular v8.2.14 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, provideClientHydration(), and withRequestsMadeViaParent() \u2014 all features that do not exist in this version. These features were introduced in Angular v16 (per patches/CVE-2026-50170.patch and patches/CVE-2026-54266.patch). The target uses the legacy NgModule-based HttpClientModule without automatic ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ], "bom-ref": "urn:uuid:c13b3fe4-7bdb-5d11-b4bb-08684a60948b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 8.2.14-tuxcare.7 of @angular/platform-webworker." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-webworker@8.2.14-tuxcare.7" } ] }