{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d3404780-da39-5484-a684-ee121bc1b2b2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4", "version": "16.2.11-tuxcare.4", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:fa86f5ed-6585-5a2a-be5b-ef9823c63210", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:74b1ac2c-48c7-5daa-8ff1-3a8e5b626b48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:822deec2-f226-54f3-8091-bd10db300971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:d4006a5b-9bc2-5e4a-93f9-83391f9451bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:e184b776-8f2e-53e7-9f79-33e7aca47601", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:e95651ea-f302-57d4-aa2d-07101417066b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:481a2dad-7c3d-5c26-8e0f-252687e27efd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:8195c4cd-45bb-5d32-80af-2d69c011830a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:f429de09-0805-57ee-a5ec-c8c6f84b7ac4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:7ddbdea7-9ac6-520a-b69f-6e4420bbb64e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:5eabdd1d-62ba-5a67-a873-02bb5fbe473a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:08d6332e-6271-5198-9e9d-1541bf252b4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:f89164d0-a37a-51e6-ad34-801877264377", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:c176a9e3-15f8-5b67-a2e1-40614352f60d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:7d81256f-17b4-5a97-9824-48111cf50e74", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:8426aa80-46d7-5ecc-ab8d-d8c059656623", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:de3fb5da-95b6-5b6a-b90e-99f025a9e105", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:1ac46b25-a641-57bf-bcdc-cd15648075c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:937ec1b5-d30b-540d-8ab2-16a15742521f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:9a0b23d2-0f29-59a5-b4a5-f02a78687114", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:c36ccd1b-3867-5d71-8637-85e179e6ffad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:c82ecb31-b985-5b31-a7bc-6c8f97adb0ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:7c736aac-8094-5bb3-b8ed-7d8603188543", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:5b44e170-bc1c-55b4-a7cf-9a7948dfca21", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:83e353c3-6bcc-58f7-8930-8e4eff2d5506", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:4c2c7d80-59c2-5c8b-bd42-4d4d473ff668", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.4 of @angular/platform-server. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:d7e35efc-6475-5944-96ed-d14a0f218a63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:9759c131-43cc-5646-a6b6-ee8f0515aff5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:d74f6df2-395e-5c16-9819-bce24d3f446a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:a22b6ad7-c5f5-50c9-b8ef-6d3a8f928b90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.11-tuxcare.4 of @angular/platform-server." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.4" } ] }