{
  "@id": "urn:uuid:6d750d83-2513-4fea-bc72-4bb0cb3a9ffd",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T16:17:01.915415+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/compiler@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/compiler@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-17T15:15:00.399521+00:00",
      "status_notes": "Vulnerability CVE-2025-66412 affects version 14.2.8 of @angular/compiler, and is fixed in 14.2.8-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-66412"
      },
      "action_statement": "Vulnerability CVE-2025-66412 affects version 14.2.8 of @angular/compiler, and is fixed in 14.2.8-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/compiler@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/compiler@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-17T15:15:00.399521+00:00",
      "status_notes": "Vulnerability CVE-2026-22610 affects version 14.2.8 of @angular/compiler, and is fixed in 14.2.8-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-22610"
      },
      "action_statement": "Vulnerability CVE-2026-22610 affects version 14.2.8 of @angular/compiler, and is fixed in 14.2.8-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/compiler@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/compiler@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-29T18:19:40.837381+00:00",
      "status_notes": "Vulnerability CVE-2026-32635 affects version 14.2.8 of @angular/compiler.",
      "vulnerability": {
        "name": "CVE-2026-32635"
      },
      "action_statement": "Vulnerability CVE-2026-32635 affects version 14.2.8 of @angular/compiler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/compiler@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/compiler@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-17T15:15:00.399521+00:00",
      "status_notes": "Vulnerability CVE-2026-50557 affects version 14.2.8 of @angular/compiler, and is fixed in 14.2.8-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-50557"
      },
      "action_statement": "Vulnerability CVE-2026-50557 affects version 14.2.8 of @angular/compiler, and is fixed in 14.2.8-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/compiler@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/compiler@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-17T15:15:00.399521+00:00",
      "status_notes": "Vulnerability CVE-2026-54265 does not affect version 14.2.8 of @angular/compiler. not_affected \u2014 Angular 14.2.8 uses the render3 compiler architecture where two-way bindings are desugared to one-way property bindings before sanitization logic runs, automatically inheriting the same sanitizers. The upstream vulnerability is specific to the template pipeline architecture with TwoWayProperty operations, which does not exist in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54265"
      },
      "impact_statement": "not_affected \u2014 Angular 14.2.8 uses the render3 compiler architecture where two-way bindings are desugared to one-way property bindings before sanitization logic runs, automatically inheriting the same sanitizers. The upstream vulnerability is specific to the template pipeline architecture with TwoWayProperty operations, which does not exist in this version."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/compiler@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/compiler@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-17T15:15:00.399521+00:00",
      "status_notes": "Vulnerability CVE-2026-69151 affects version 14.2.8 of @angular/compiler, and is fixed in 14.2.8-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-69151"
      },
      "action_statement": "Vulnerability CVE-2026-69151 affects version 14.2.8 of @angular/compiler, and is fixed in 14.2.8-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/compiler@14.2.8",
          "identifiers": {
            "purl": "pkg:npm/%40angular/compiler@14.2.8"
          }
        }
      ],
      "timestamp": "2026-10-17T15:15:00.399521+00:00",
      "status_notes": "Vulnerability CVE-2026-88057 affects version 14.2.8 of @angular/compiler, and is fixed in 14.2.8-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-88057"
      },
      "action_statement": "Vulnerability CVE-2026-88057 affects version 14.2.8 of @angular/compiler, and is fixed in 14.2.8-tuxcare.6."
    }
  ]
}