{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:14397589-bf8a-56a8-9020-14d2fa6d8a11", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/core", "purl": "pkg:npm/%40angular/core@8.0.3-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8", "version": "8.0.3-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:c4924f88-ea63-50c7-9be0-05727aa1adc1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 8.0.3-tuxcare.8 of @angular/core." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:ee0d3af9-bbc3-58ff-9b44-318fb1cf71da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 8.0.3-tuxcare.8 of @angular/core." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:ff55e686-a49f-5d60-b672-49a48a2cb1a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.0.3-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:37cf6dbd-9c91-5bbd-9bd1-057a37a40da0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 8.0.3-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:ff9ff50d-0c4f-5300-acd1-0b223b834109", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 8.0.3-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:81763bfb-edf2-5c72-a7b1-a30d7fc6099c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 8.0.3-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:482c0987-e7d0-5474-8ab8-6446e84ddf0c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 8.0.3-tuxcare.8 of @angular/core. not_affected \u2014 The target Angular version 8.0.3 is not affected by CVE-2026-41423. The vulnerability requires WHATWG URL API (introduced in Angular 8.2.x+) to manifest the hostname override behavior. Version 8.0.3 uses Node.js legacy url.parse() which does not interpret protocol-relative URLs as having attacker-controlled hostnames.", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:8f90dd80-8d69-56e7-b513-8d9418b9038a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 8.0.3-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:e42311a6-9c2e-52c1-9f4a-b2e398dfddcd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 8.0.3-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:c246e02b-31f7-52ae-a6cc-8905a4d8c62f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 8.0.3-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:9577b6d9-3035-57ed-b97b-faa505718c2f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 8.0.3-tuxcare.8 of @angular/core. not_affected \u2014 The target Angular v8.0.3 is NOT affected by CVE-2026-50170. The vulnerability requires the HTTP transfer cache feature (packages/common/http/src/transfer_cache.ts) and client hydration mechanisms, which were introduced in Angular v16+. This version lacks the entire affected component.", "justification": "code_not_present" } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:b36ab6d2-5252-5808-a9e1-ae45efb36713", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 8.0.3-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:e89ef858-63fd-59a6-8c6b-f37f594e4c78", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 8.0.3-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:010bb620-3619-5320-b44e-931e95cd19d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 8.0.3-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:c23c4836-a757-57a7-b6b5-5419c9997a22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 8.0.3-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:b86d5680-5e95-5e1a-b30f-7f39d6cacc39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 8.0.3-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:405c115b-92d2-5eca-8097-b87942c4e05b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 8.0.3-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:8eadaeac-c99d-5a95-98c9-a5736834f5c9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 8.0.3-tuxcare.8 of @angular/core. not_affected \u2014 The target Angular service-worker version 8.0.3-tuxcare.4 is NOT AFFECTED by CVE-2026-54264. The vulnerability requires the service worker to copy and forward request headers during cross-origin redirects. This version never copies headers: the AssetGroup path creates fresh requests from URLs only (no header preservation), and the DataGroup path delegates to the browser's spec-compliant fetch A...", "justification": "code_not_present" } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:ce1c5e33-198b-5281-ab4c-0c4ee743a3e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 8.0.3-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:f2db7961-0ef0-5ee0-aa48-e906bdb48cb8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 8.0.3-tuxcare.8 of @angular/core. not_affected \u2014 Angular 8.0.3-tuxcare.4 is NOT affected by CVE-2026-54266. The vulnerable HttpTransferCache feature with its weak DJB2 hash-based cache key generation does not exist in this version. HttpTransferCache was introduced in Angular v16+, while this target is v8.0.3.", "justification": "code_not_present" } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:118cd759-c42e-546a-83eb-3a609129ca22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 8.0.3-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:2e10bfb0-bc68-5cb8-a840-b3e3eb4a7387", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 8.0.3-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:434966d5-9661-5802-b0bd-70763f0bc184", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 8.0.3-tuxcare.8 of @angular/core. not_affected \u2014 Angular 8.0.3-tuxcare.5 is NOT AFFECTED by CVE-2026-68945. The vulnerability concerns HttpTransferCache, a feature that caches HTTP requests during Server-Side Rendering (SSR) and generates cache keys that incorrectly treat scalar-comma parameters (role=user,admin) as identical to repeated parameters (role=user&role=admin). This feature does not exist in Angular 8.0.3 \u2014 it was introduced in Ang...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:bd4d7655-8c82-5f6c-ab69-3906fb8be399", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 8.0.3-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:dbc73667-75a5-5b4c-b01d-07b6bd216372", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 8.0.3-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:314aa6c6-e9d1-501c-91e7-27c1dc2d6f90", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 8.0.3-tuxcare.8 of @angular/core. not_affected \u2014 Angular 8.0.3 is not affected by CVE-2026-88056. The vulnerability exists only in later Angular versions (v19+, v20+, v21+, v22+) where packages/platform-server/src/url.ts contains a parseUrl function that calls String.prototype.trim() on URL strings. This trim() call strips Unicode whitespace (U+00A0, U+FEFF), converting same-origin URLs into cross-origin protocol-relative URLs, causing SSRF. ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:bbdfa7d1-099a-55d4-adf2-dcab3b0693ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 8.0.3-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:0b31be15-8355-52c5-a740-771a88e1cd55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 8.0.3-tuxcare.8 of @angular/core." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:94d4c25d-a7a6-5799-b985-7ed87dbd162d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 8.0.3-tuxcare.8 of @angular/core. not_affected \u2014 Angular v8.0.3 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache, withRequestsMadeViaParent(), and modern SSR hydration features that were introduced in Angular v16+. Version 8.0.3 predates these features by multiple major releases. The legacy TransferState in v8 is a manual key-value store with no integration with HttpClient, making the described attack chain impo...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ], "bom-ref": "urn:uuid:ef620332-212e-5287-9073-2dee952de02d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 8.0.3-tuxcare.8 of @angular/core." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/core@8.0.3-tuxcare.8" } ] }