{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:eed9750d-ef5e-53f1-923d-8efad4779277", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6", "version": "16.2.11-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:f75e8ad7-03a3-5418-a9b5-a06a5f718516", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:85dac268-5bfc-5cbb-ad91-eff4a2847ba5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:5bb68cd7-2a90-5e6e-8472-f18ceab372ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:69375677-3178-50d9-8edf-93ed20f0dd6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:0ddf82ac-8174-54e7-9e17-ae1e3b156b37", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:cbb3e37c-1669-5b1e-b082-be49256970db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:2d0ef88b-de6c-5428-b3be-1cff5587e982", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:4dd826ab-0745-56af-ab73-ecf0b938dffd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d7b8a2ea-d5c0-5831-bb0c-e36b6674b70b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:84de4bf7-d11c-5c89-8d44-45f4ff657cfd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:436959ac-b044-5e3d-900b-1041cb74d73f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:3d82950f-07c9-5d9d-bf33-043fe0182c6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:f5188eb3-ab51-5f52-90cc-ddb17efbc28c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:7a7d3e30-bbab-5d88-9206-b548a3b818b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:53cd8a61-022b-558d-990e-e95ee939be78", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:f9a612b2-7511-5486-8b39-f9e91ccecf10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:44548df3-ba76-590f-b75a-153137697b40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:9cf8512d-e655-54d7-8e99-956011eea22d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ec4bd8b5-d017-5f5d-8244-6483e705e378", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:cbf98330-6042-512f-9e04-f41bd227ebeb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:7a58a8e8-2e92-530a-92a8-ca93b30d122f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:2f97fb17-6674-564c-a7d7-eab0ecc9d913", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:846faf8b-24b2-53a7-a178-c98d4b5d5a23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:0fbf3d14-fc3c-5859-a4e3-403e793119f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:f4c253a7-5ab5-55f5-b211-4e15358bc41f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a28f9003-6790-5171-919c-00053e3e9d3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:9893dfd1-c6b4-59b0-b29e-3d4e473a53ee", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.6 of @angular/platform-server. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:38f4f66c-6351-5259-88e9-368aadd1b768", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:e21240b8-b07d-5a78-8288-96b463dd2d64", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:64804a9b-01be-5d5b-92d9-b346663d06f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ], "bom-ref": "urn:uuid:2cc7f23a-262e-5bfa-8d21-7d8e3a7b7698", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.11-tuxcare.6 of @angular/platform-server." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.6" } ] }