{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a6927617-9815-56f8-912a-7f89efeb96c5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12", "type": "library", "bom-ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12", "version": "8.0.3-tuxcare.12", "pedigree": { "ancestors": [ { "name": "@angular/bazel", "purl": "pkg:npm/%40angular/bazel@8.0.3", "type": "library", "version": "8.0.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:fd1c301f-776d-5907-bf1d-0e3f091ec9f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:4bcb931d-5f63-56f0-ab3e-252645051b19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:bd8fac2b-88b3-5317-b6e4-23d9997516e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:62b57e85-a3a5-5e4a-80b3-5c6d0e056fa1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:7183948b-4788-5404-a0d5-e593e9f6736f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 8.0.3-tuxcare.12 of @angular/bazel. not_affected \u2014 The target Angular version 8.0.3 is not affected by CVE-2026-41423. The vulnerability requires WHATWG URL API (introduced in Angular 8.2.x+) to manifest the hostname override behavior. Version 8.0.3 uses Node.js legacy url.parse() which does not interpret protocol-relative URLs as having attacker-controlled hostnames.", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:5fd44873-6a49-58a7-a839-043cdbdf9a3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:f48fd12d-5f9c-554c-a2d2-1be291cde761", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:c0ae153f-bff9-59be-9d7a-93861dad3f2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:6df15584-bf43-52f7-b802-a2fd2432e9fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:7eb368a8-ba17-565b-82a3-e084bf50bd77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:e7aff3d4-8ab4-5b8b-8038-62342f5a40d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:4f3bfb54-dc8c-5833-aef7-6e2834195f47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:704dd77d-dd2b-5769-afd2-62a6a322ed46", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 8.0.3-tuxcare.12 of @angular/bazel. not_affected \u2014 The target Angular service-worker version 8.0.3-tuxcare.4 is NOT AFFECTED by CVE-2026-54264. The vulnerability requires the service worker to copy and forward request headers during cross-origin redirects. This version never copies headers: the AssetGroup path creates fresh requests from URLs only (no header preservation), and the DataGroup path delegates to the browser's spec-compliant fetch A...", "justification": "code_not_present" } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:78aa7ed2-531e-53c8-a4b8-ab88a19805d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:01f5ea62-3935-5d45-88ba-5049a760e1a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:603aa17b-d2bb-5923-8b71-113d2909a720", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:49ef0039-c744-5e61-a31c-17d32f69a8e6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 8.0.3-tuxcare.12 of @angular/bazel. not_affected \u2014 Angular 8.0.3 is not affected by CVE-2026-88056. The vulnerability exists only in later Angular versions (v19+, v20+, v21+, v22+) where packages/platform-server/src/url.ts contains a parseUrl function that calls String.prototype.trim() on URL strings. This trim() call strips Unicode whitespace (U+00A0, U+FEFF), converting same-origin URLs into cross-origin protocol-relative URLs, causing SSRF. ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:566b2950-a5bb-5b24-8b1a-5a310ba5fea6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:3f49bbb3-fe75-5845-96e7-0d3aa87c0bd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ], "bom-ref": "urn:uuid:e2f4272a-3074-502e-a7f1-ce8b96a216c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 8.0.3-tuxcare.12 of @angular/bazel." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/bazel@8.0.3-tuxcare.12" } ] }