{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:cb0bf8e7-18b3-5406-81bd-56374e763395", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/compiler-cli", "purl": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12", "type": "library", "bom-ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12", "version": "8.2.14-tuxcare.12", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:d6a43482-4ed5-5110-a408-06626cfe4c68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 8.2.14-tuxcare.12 of @angular/compiler-cli." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:8b3f57e6-eabb-5fb0-b116-8433ed07ca2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 8.2.14-tuxcare.12 of @angular/compiler-cli." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:56563218-91f3-54ef-a573-7aee32c01854", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.2.14-tuxcare.12 of @angular/compiler-cli." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:28c7aae0-d165-5c55-986a-33b4de417667", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 8.2.14-tuxcare.12 of @angular/compiler-cli." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:363644dc-00dc-5476-bbdb-53ab3af81e80", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 8.2.14-tuxcare.12 of @angular/compiler-cli." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:e905f316-781e-538a-9cda-04cc0fe5b09c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 8.2.14-tuxcare.12 of @angular/compiler-cli." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:b920833d-9aaa-5c47-a004-bb3189269fef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 8.2.14-tuxcare.12 of @angular/compiler-cli." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:5463f0e0-574e-53c5-b28f-5a228e191d71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 8.2.14-tuxcare.12 of @angular/compiler-cli." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:de441a38-dbad-518c-94eb-db99097da8d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 8.2.14-tuxcare.12 of @angular/compiler-cli." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:566babaa-6c09-55bd-8abe-9484c256273e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 8.2.14-tuxcare.12 of @angular/compiler-cli." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:ac1a33b5-2e71-5220-aa14-17e304b142ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 8.2.14-tuxcare.12 of @angular/compiler-cli." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:ad5d0240-8359-5fd0-9217-f25a2d965e2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 8.2.14-tuxcare.12 of @angular/compiler-cli." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:56bdf2f1-bad7-5bbc-a6de-8cb845a2757a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 8.2.14-tuxcare.12 of @angular/compiler-cli." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:c1983ca7-4e26-567f-baa5-b6310e5c03bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 8.2.14-tuxcare.12 of @angular/compiler-cli." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:96585f93-255c-5f6a-b632-6620460fc230", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 8.2.14-tuxcare.12 of @angular/compiler-cli." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:ba471ada-8e04-536c-acd8-9d32da21267c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 8.2.14-tuxcare.12 of @angular/compiler-cli." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:860ea07d-865c-5164-abbc-2fa767c8339d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 8.2.14-tuxcare.12 of @angular/compiler-cli." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:9f7256d9-cebe-506d-8659-87d70086d270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 8.2.14-tuxcare.12 of @angular/compiler-cli." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:0efc6296-86cf-59f7-a4f3-ab1e1749d2b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 8.2.14-tuxcare.12 of @angular/compiler-cli." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:ce40555c-7914-5360-b06a-c3cddd0bfca0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 8.2.14-tuxcare.12 of @angular/compiler-cli." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:f3f4703f-c920-5f22-b342-77db727f64da", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 8.2.14-tuxcare.12 of @angular/compiler-cli. not_affected \u2014 Angular 8.2.14 is NOT affected by CVE-2026-68945. The vulnerability exists in HttpTransferCache, a feature that automatically caches HTTP requests during SSR for client hydration. HttpTransferCache was introduced in Angular v16+ and does not exist in version 8.2.14. This version has only a manual TransferState key-value store with no automatic HttpClient integration, and no HTTP caching mechani...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:dc983d31-7030-55a6-a1fc-e67b1622c868", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 8.2.14-tuxcare.12 of @angular/compiler-cli." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:a14133ad-5c36-52c9-a9e2-7ca36ec48422", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 8.2.14-tuxcare.12 of @angular/compiler-cli." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:7ee6e0e5-0f37-5362-9c95-8e573ef0747f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 8.2.14-tuxcare.12 of @angular/compiler-cli. not_affected \u2014 Angular 8.2.14 is NOT AFFECTED by CVE-2026-88056. The vulnerability requires a sophisticated URL resolution utility (`parseUrl` in `packages/platform-server/src/url.ts`) that calls `String.prototype.trim()` to strip Unicode whitespace, creating a discrepancy with WHATWG URL validation. This architecture was introduced in Angular v12+ (circa 2026 as TuxCare backports). Angular 8.2.14 (released N...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:7c861ea3-2b80-5db7-8b1a-8350ec9ba991", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 8.2.14-tuxcare.12 of @angular/compiler-cli." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:92f97314-abe7-5503-a7c1-9441e5162b45", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 8.2.14-tuxcare.12 of @angular/compiler-cli. not_affected \u2014 Angular v8.2.14 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, provideClientHydration(), and withRequestsMadeViaParent() \u2014 all features that do not exist in this version. These features were introduced in Angular v16 (per patches/CVE-2026-50170.patch and patches/CVE-2026-54266.patch). The target uses the legacy NgModule-based HttpClientModule without automatic ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ], "bom-ref": "urn:uuid:b2677767-7d3b-5b61-819a-3d03b3b93aa1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 8.2.14-tuxcare.12 of @angular/compiler-cli." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/compiler-cli@8.2.14-tuxcare.12" } ] }