{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:071f3854-3191-58b6-87cb-4c7129cfe22e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5", "version": "7.2.0-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:de190993-9817-5eed-ad63-6e769e8747a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:74fddde2-3eb5-5287-ab5e-9e9be0cb0553", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:b6783ec7-a909-5520-8107-224ec2917d6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:c0bf6e55-900d-5ffd-954c-92a67bd4643f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:3a4ab2b4-004a-5321-89a9-d98f3d675e17", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:1c38c727-0ac2-5f98-89ac-172d92fce0a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:7cbbc786-46c3-522d-b972-f423170c82ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:874fc0c2-a6b0-50d4-9b8f-0bea37907cbf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:701211e8-bde6-5a78-b0d4-afe4686ea1c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:18abab1e-e08f-58cc-9e58-3a3bbf5f5a83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:8e1d7a02-bbbc-5f14-9549-393efff441eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:705c666c-55aa-5161-8ffd-5cbfbbb0cd70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:849d5cb7-010d-545e-bde1-3a25dc92a841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:08dece2d-e5cd-568c-a09e-a53a816d74e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:aaed2497-9c28-56fe-8cca-268483bc4ab9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:039c8f4f-f491-58a1-a626-d7118b956400", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:de3777dc-a480-563d-b501-53eff1aeedb2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:6a07edb1-03fc-5057-a024-ef92f58e4500", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:26f2e501-4079-5d7f-bff2-40c41e454ef0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:6b0792b0-6e61-5220-829b-ab4b6e256e3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:ab1c5498-736d-5b1d-9461-4b9965477e8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:55397d9e-777a-5d50-8661-dc52dfbf8897", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:1798f9ba-f750-515b-a4c4-ee9fa99ae2ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:0461150a-cfa4-5f7b-b492-f2bc16f018fa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 7.2.0-tuxcare.5 of @angular/platform-server. not_affected \u2014 Angular v7.2.0 is NOT AFFECTED by CVE-2026-68945. The vulnerable component (HttpTransferCache) does not exist in this version. According to patch documentation in the repository (CVE-2026-50170.patch, CVE-2026-54266.patch), the HTTP transfer-cache and client hydration features were introduced in Angular v16. Angular v7.2.0 predates this feature by many major versions. Exhaustive searches confir...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:b43c9e77-ea04-5db0-a716-59bc0f548e4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:3aae4e3d-bddd-5f5b-90fa-8d3a099dd1c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:7c93bd8d-fc82-511e-92fd-b0e064933acf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 7.2.0-tuxcare.5 of @angular/platform-server. not_affected \u2014 Angular version 7.2.0 is not affected by CVE-2026-88056. The vulnerability requires the presence of a `parseUrl` function in `packages/platform-server/src/url.ts` that uses `String.prototype.trim()` to normalize URLs, which strips Unicode whitespace and can convert validated same-origin relative URLs into cross-origin protocol-relative URLs. Version 7.2.0 does not contain the `url.ts` file; it ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:81ba7c0e-2859-547b-b8bf-71261dda5aaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:3c70b08c-b1cb-5735-89ff-294745450d8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:732b3a0f-0fbf-52c7-a2e3-dd5aa2fc19d1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 7.2.0-tuxcare.5 of @angular/platform-server. not_affected \u2014 Angular v7.2.0 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache, hierarchical HttpClient delegation (withRequestsMadeViaParent()), and automatic HTTP response caching features that were introduced in Angular v16+. Version 7.2.0 uses NgModule-based configuration (HttpClientModule) with manual TransferState only\u2014no automatic HTTP-to-TransferState caching exists. The...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ], "bom-ref": "urn:uuid:ebecd566-5fd1-55ef-ac23-f66059347168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 7.2.0-tuxcare.5 of @angular/platform-server." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.5" } ] }