{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:687d28bb-5d1e-52bd-8811-670aa1e437d1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5", "version": "16.2.11-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:fea9f7d2-003d-5351-a1a8-57aaf5fff433", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:d8c849e0-82a0-5816-9a8f-e6672b043b57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:4a204053-176a-5a81-b342-f9ef3fa5e006", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:1a4d8451-db5a-5db0-bb28-caa2b27d660e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 16.2.11-tuxcare.5 of @angular/platform-server, and is fixed in 16.2.11-tuxcare.6." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:62d54936-fb8d-5497-9d38-381e6c0cb4f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:9372a29d-e3db-5142-bab1-ea5483e3407b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:b9f11252-bcb1-528d-985a-0fbf479c9ba5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:2d7d6531-64e9-5600-9965-c77cf5840dab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:0c9c0b17-cb37-51a3-befd-4f1b316a9a79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:aa612bd3-56e0-537b-beec-24d95b5e0779", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:00f26762-7991-50b2-8291-03ff9cdc2670", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:e28a1e34-2ed9-529c-a2bf-159e67e6c17b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:c818d7ad-60db-57d3-93aa-06a54cae0e19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:4491e80f-ffd8-5e0f-ba56-a26e906b7276", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:12cd3660-50c9-5707-b0b4-8b1ad8bb9a71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:fa5ceb10-eadd-5f41-988f-a1ce5584856f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:66fc8df3-2718-5c5b-ab8d-ba26e95edc7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:51aa3aa6-4906-5698-bfd6-4030885b7a2d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:5fa5bbfd-410a-5198-9e57-c15fe29fa0bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:a2a93459-5301-5726-939d-4f12bd70c8e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:a31a6f21-87db-5ec1-ad2e-c8c3bf1e2757", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:d7662a7d-0c53-5cee-9439-fe5a1588db27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:ab26a097-0527-5b44-8876-6453c3922fe9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:0f526873-c88a-5a6c-b208-c3b618aed2ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:ccb0a2fd-a477-5191-99ed-b5f7a5f4c70c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:4a541fc3-7d7a-59ad-a1f8-2fecc4169ebe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:2b169295-0bb8-5210-bf8a-030cd3007ee1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.5 of @angular/platform-server. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:f46f442e-fd4e-5942-b37b-532add6f86ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:d9a389c1-1bb4-5924-9305-e1fa123325ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:e51f75cf-05bd-510e-b66b-749983157dd0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:7c154a30-09ed-5381-99d0-255fca793372", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.11-tuxcare.5 of @angular/platform-server." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.5" } ] }