{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0c0182ca-b074-5855-9cbc-dcbadf0d9f70", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/upgrade", "purl": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4", "version": "8.2.14-tuxcare.4", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:888afd81-be7d-59d5-adfb-70fc47ea33d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-4231 affects version 8.2.14-tuxcare.4 of @angular/upgrade, and is fixed in 8.2.14-tuxcare.5." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:23ab128e-f145-5f13-897d-26d9d76fabfe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 8.2.14-tuxcare.4 of @angular/upgrade, and is fixed in 8.2.14-tuxcare.10." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:54af510e-dc44-5715-a0b0-de1ddf64d17e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.2.14-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:406afd7f-f053-5660-a9a9-a960877d4e88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 8.2.14-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:26e61708-ff90-506e-99c8-264ab5a207ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 8.2.14-tuxcare.4 of @angular/upgrade, and is fixed in 8.2.14-tuxcare.6." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:bf0e2a59-8ff7-52a8-93c5-ef0711b2333f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 8.2.14-tuxcare.4 of @angular/upgrade, and is fixed in 8.2.14-tuxcare.8." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:23cdf292-e534-5bdf-bb31-f216c9639148", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 8.2.14-tuxcare.4 of @angular/upgrade, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:cda6cade-ddf4-5329-ad8d-2ff158c8654e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 8.2.14-tuxcare.4 of @angular/upgrade, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:916d5f8e-f43b-5ca7-b267-01436bd4ebc4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 8.2.14-tuxcare.4 of @angular/upgrade, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:a827a035-6b93-5817-8f02-b4e293b68b88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 8.2.14-tuxcare.4 of @angular/upgrade, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:4ffa10ee-3a46-5410-a126-7d8edceb2af7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 8.2.14-tuxcare.4 of @angular/upgrade, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:f232addc-9ee5-5d69-8fff-a2c1ca5ebc87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 8.2.14-tuxcare.4 of @angular/upgrade, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:ec827b87-d3a8-5ee0-818d-8081cd0a9a4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 8.2.14-tuxcare.4 of @angular/upgrade, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:27d67019-4045-563b-9382-d87e59ca89cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 8.2.14-tuxcare.4 of @angular/upgrade, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:e1eaebfd-fdbd-5c6e-a6e9-bbbd1b82d2aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 8.2.14-tuxcare.4 of @angular/upgrade, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:598f0863-35d3-519b-9541-0282f813c8f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 8.2.14-tuxcare.4 of @angular/upgrade, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:78abb83f-4531-524a-8129-cfb75d1a2a57", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 8.2.14-tuxcare.4 of @angular/upgrade, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:bcc24bd6-56dd-552c-88ea-1010059e82c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 8.2.14-tuxcare.4 of @angular/upgrade, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:6fb7a500-0f44-57ac-955f-20c0fc1ad2b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 8.2.14-tuxcare.4 of @angular/upgrade, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:7de21512-10c2-530f-81ef-3e6810d5eba5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 8.2.14-tuxcare.4 of @angular/upgrade, and is fixed in 8.2.14-tuxcare.9." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:1901ca38-a31c-5aab-8269-ffac79a0c1c9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 8.2.14-tuxcare.4 of @angular/upgrade. not_affected \u2014 Angular 8.2.14 is NOT affected by CVE-2026-68945. The vulnerability exists in HttpTransferCache, a feature that automatically caches HTTP requests during SSR for client hydration. HttpTransferCache was introduced in Angular v16+ and does not exist in version 8.2.14. This version has only a manual TransferState key-value store with no automatic HttpClient integration, and no HTTP caching mechani...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:9ffab95c-b748-5df3-b53f-5afefb30d89c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 8.2.14-tuxcare.4 of @angular/upgrade, and is fixed in 8.2.14-tuxcare.11." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:9c70bae6-0622-54c3-84d5-6032d0d4c8b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 8.2.14-tuxcare.4 of @angular/upgrade, and is fixed in 8.2.14-tuxcare.11." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:e7609ff2-b222-5a10-86af-bbb40fb85495", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 8.2.14-tuxcare.4 of @angular/upgrade. not_affected \u2014 Angular 8.2.14 is NOT AFFECTED by CVE-2026-88056. The vulnerability requires a sophisticated URL resolution utility (`parseUrl` in `packages/platform-server/src/url.ts`) that calls `String.prototype.trim()` to strip Unicode whitespace, creating a discrepancy with WHATWG URL validation. This architecture was introduced in Angular v12+ (circa 2026 as TuxCare backports). Angular 8.2.14 (released N...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:aba93ce6-c12f-59f3-8f77-b3f1e97e0d5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 8.2.14-tuxcare.4 of @angular/upgrade." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:a9053203-9888-5b2a-8c1b-a17af76656f2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 8.2.14-tuxcare.4 of @angular/upgrade. not_affected \u2014 Angular v8.2.14 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, provideClientHydration(), and withRequestsMadeViaParent() \u2014 all features that do not exist in this version. These features were introduced in Angular v16 (per patches/CVE-2026-50170.patch and patches/CVE-2026-54266.patch). The target uses the legacy NgModule-based HttpClientModule without automatic ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ], "bom-ref": "urn:uuid:1f5b7f83-c89c-5707-84bd-8d887353a28a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 8.2.14-tuxcare.4 of @angular/upgrade." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/upgrade@8.2.14-tuxcare.4" } ] }