{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a03f64e7-77b2-5dc2-835b-5f5c99c1868f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16", "type": "library", "bom-ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16", "version": "8.2.14-tuxcare.16", "pedigree": { "ancestors": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@8.2.14", "type": "library", "version": "8.2.14" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:748a376a-746a-5de4-b9eb-1a4f541f31c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:502d2c82-14e6-5aee-90ec-97d9c20b68d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:4934348a-5b69-5747-b28f-6a24bec89bd4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:56814a40-fa81-59c8-8302-c8d0463aa8fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:54e963b3-6187-502d-a28a-c011aaa56456", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:3b38e1a4-0cf9-534a-a709-1e89abe08a34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:a6d92815-978d-5fd6-af8f-39251c477482", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:07d37839-d73d-58da-8aed-4903ce0ab0a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:c3566eaf-2737-5b64-bb91-5c81d569b8d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:f82b5d64-9809-5005-954b-d253ec07d8b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:e8c9a296-e5d5-57ac-8563-bc64b8cfe7e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:f5af167f-03fb-5052-a40e-d812b86e9e7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:7d3e5754-f5aa-5742-ae49-49cb8635687e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:5e51e1a9-c798-554d-b170-d05ee5c43fcd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:7c99006e-aa60-56e7-a031-29eb76645942", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:aa04c1c5-4dfd-55a0-af0b-518001999643", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:d7459231-76d9-55c9-a1f6-353ca572d83b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:891b030b-be83-56d4-a8c1-44846638c0de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:4041fafe-0407-5b4c-ad0a-98dddb2fced4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:b678b481-c164-573e-850f-25378784c16f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:1951d442-03a9-52f2-be51-c10ee5e839be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:59f9ffb8-f504-5fe9-9664-a5fa9b6f0ac0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:4595ab20-f03d-5bb4-9721-126153af372f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:558596f7-5626-5046-a5d4-8938cd002026", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 8.2.14-tuxcare.16 of @angular/bazel. not_affected \u2014 Angular 8.2.14 is NOT affected by CVE-2026-68945. The vulnerability exists in HttpTransferCache, a feature that automatically caches HTTP requests during SSR for client hydration. HttpTransferCache was introduced in Angular v16+ and does not exist in version 8.2.14. This version has only a manual TransferState key-value store with no automatic HttpClient integration, and no HTTP caching mechani...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:eaf64fed-2dcb-5a61-ab01-506a0cf1750c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:bbed95ce-0604-5c53-8f93-74ae60f79eaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:bd74070d-52cb-52b1-8d1f-0f8765d6ab91", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 8.2.14-tuxcare.16 of @angular/bazel. not_affected \u2014 Angular 8.2.14 is NOT AFFECTED by CVE-2026-88056. The vulnerability requires a sophisticated URL resolution utility (`parseUrl` in `packages/platform-server/src/url.ts`) that calls `String.prototype.trim()` to strip Unicode whitespace, creating a discrepancy with WHATWG URL validation. This architecture was introduced in Angular v12+ (circa 2026 as TuxCare backports). Angular 8.2.14 (released N...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:97172c9a-049a-51fa-bccb-75752482773d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:16cae4db-0688-5820-8914-ebb868832da4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:58947516-620a-544c-bb25-0e52140279b7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 8.2.14-tuxcare.16 of @angular/bazel. not_affected \u2014 Angular v8.2.14 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, provideClientHydration(), and withRequestsMadeViaParent() \u2014 all features that do not exist in this version. These features were introduced in Angular v16 (per patches/CVE-2026-50170.patch and patches/CVE-2026-54266.patch). The target uses the legacy NgModule-based HttpClientModule without automatic ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ], "bom-ref": "urn:uuid:bff17282-42d2-51bf-9781-849a6386d1d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 8.2.14-tuxcare.16 of @angular/bazel." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/bazel@8.2.14-tuxcare.16" } ] }