{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1cb75c12-c23d-5ca9-ab7e-ddbb06b3152b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9", "type": "library", "bom-ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9", "version": "8.2.14-tuxcare.9", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:8f2d37bc-04ac-540c-9b34-c6317a7ca51f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 8.2.14-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:aa5ab987-628d-59cc-9faa-23cfa37d8ab8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 8.2.14-tuxcare.9 of @angular/bazel, and is fixed in 8.2.14-tuxcare.10." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:229c67ed-f6e3-5c1a-8913-f3929c68538b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.2.14-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:b7c6da4c-3707-54a6-a026-1b17a68a4235", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 8.2.14-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:ec592efc-1655-5343-b42f-273e774ccfa5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 8.2.14-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:121aedf5-4310-5d2e-83ec-6d6c636e91a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 8.2.14-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:6eec190b-b5f7-5328-a5d7-5b51d983a657", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 8.2.14-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:cb1a61ac-af87-5f9a-a60b-0b5ad6febd54", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 8.2.14-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:10c449c7-6736-5ab0-8496-108f1ceac327", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 8.2.14-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:4bad147c-626e-5c21-a1a7-5e1cdca99aae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 8.2.14-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:ee792b1f-8e9c-54a9-a6f9-374144797efc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 8.2.14-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:5badf608-e19e-5a9b-bd34-ec340a0cbbdb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 8.2.14-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:ae929809-cb6f-5658-b8d7-70f05441d4d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 8.2.14-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:08423b24-6b78-5eb2-bf22-7c4d2c95af69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 8.2.14-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:5fff4c5d-96c1-5a56-becb-5de0ddc617d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 8.2.14-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:56f2063c-b7f5-5c81-8cf0-5721d11c65db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 8.2.14-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:1d0548ec-b639-5f66-97b0-ddd2e1add1d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 8.2.14-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:be4a9ca1-dd40-5b79-a9a1-2d1d956dc984", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 8.2.14-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:541d0704-f073-5930-a156-203bd7df281a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 8.2.14-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:73900906-27a1-57ba-b479-328a927fa35a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 8.2.14-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:dd4b3190-a2b6-54ce-a8f5-b4d364e9ed59", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 8.2.14-tuxcare.9 of @angular/bazel. not_affected \u2014 Angular 8.2.14 is NOT affected by CVE-2026-68945. The vulnerability exists in HttpTransferCache, a feature that automatically caches HTTP requests during SSR for client hydration. HttpTransferCache was introduced in Angular v16+ and does not exist in version 8.2.14. This version has only a manual TransferState key-value store with no automatic HttpClient integration, and no HTTP caching mechani...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:f6537f96-69c6-539a-b67a-88542509198e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 8.2.14-tuxcare.9 of @angular/bazel, and is fixed in 8.2.14-tuxcare.11." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:115c38bb-178a-561e-b156-a115de876a9a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 8.2.14-tuxcare.9 of @angular/bazel, and is fixed in 8.2.14-tuxcare.11." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:61ef16b2-85fe-5248-a55b-528730145fba", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 8.2.14-tuxcare.9 of @angular/bazel. not_affected \u2014 Angular 8.2.14 is NOT AFFECTED by CVE-2026-88056. The vulnerability requires a sophisticated URL resolution utility (`parseUrl` in `packages/platform-server/src/url.ts`) that calls `String.prototype.trim()` to strip Unicode whitespace, creating a discrepancy with WHATWG URL validation. This architecture was introduced in Angular v12+ (circa 2026 as TuxCare backports). Angular 8.2.14 (released N...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:56017226-7d76-564f-bbba-f7fe8f98f10b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 8.2.14-tuxcare.9 of @angular/bazel." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:28d58d38-8d46-5777-8ced-e8ec962da91c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 8.2.14-tuxcare.9 of @angular/bazel. not_affected \u2014 Angular v8.2.14 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, provideClientHydration(), and withRequestsMadeViaParent() \u2014 all features that do not exist in this version. These features were introduced in Angular v16 (per patches/CVE-2026-50170.patch and patches/CVE-2026-54266.patch). The target uses the legacy NgModule-based HttpClientModule without automatic ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ], "bom-ref": "urn:uuid:ca47404c-2e3b-5ed3-b618-661d3a61549e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 8.2.14-tuxcare.9 of @angular/bazel." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.9" } ] }