{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6dc1fd10-faf4-5df2-9d3e-f4bcf73fd8b4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4", "version": "7.2.0-tuxcare.4", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:ce38e7aa-1b2d-5e9c-9892-b96649aa048c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:b2b88fa3-7c27-57f4-8678-179691683aab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:661392cc-412c-5614-a50b-47579466d95f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:7aa8c3b6-8e48-5588-ad77-de6cc6ac1556", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101895 does not affect version 7.2.0-tuxcare.4 of @angular/platform-server. not_affected \u2014 CVE-2026-101895 affects domino's HTML parser (lib/HTMLParser.js), which is declared as a dependency in Angular's package.json (domino@2.1.0) but is NOT vendored or present in this repository's source tree. While Angular SSR applications using this version ARE exploitable (user input via [innerHTML] bindings reaches domino's vulnerable parser without DOCTYPE validation), the TARGET REPOSITORY do...", "justification": "requires_dependency" } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:6acd5150-8380-528f-9590-2d7d750fd4b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:7041d609-81a1-5f74-80b3-d69daa0328d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:31e88ccb-a58c-5b44-878e-ec40b16bbda6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:1810857e-b629-5d79-b4a2-c2ef69bbba40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:7d590d4a-1b42-542b-bc1e-9d6666393c07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:13972dd2-3815-54d0-a682-06d11781aa59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:3e981c57-a674-5a30-9222-cd0a69fe925f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:f7b68709-a249-52ca-8de4-d9684a0a254e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:90dc5120-3c36-546d-8b2f-08e87b3bf035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:17122374-9476-594f-aebe-9c2f2fb669d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:13ba467e-1605-5e6f-a278-54c58bb8d68f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:14552a5e-a3c3-554f-b93b-c6a588210464", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:105769ac-73d7-59c1-b430-85279f41dc17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:2cc52e8d-6780-5903-bdcd-90db8ff7f1d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:63520474-846d-561b-988f-6d5be31d4b90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:122acade-acd2-58cc-a8c3-a3da05f6d33a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:2d2449cf-2151-51d7-80fc-529135bb3d71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:f32682ce-d21d-5b96-a8f4-50a65daa4e39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:f43990a1-74e9-514b-860e-cc884ad86dd7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 7.2.0-tuxcare.4 of @angular/platform-server. not_affected \u2014 Angular v7.2.0 is NOT AFFECTED by CVE-2026-68945. The vulnerable component (HttpTransferCache) does not exist in this version. According to patch documentation in the repository (CVE-2026-50170.patch, CVE-2026-54266.patch), the HTTP transfer-cache and client hydration features were introduced in Angular v16. Angular v7.2.0 predates this feature by many major versions. Exhaustive searches confir...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:258ef192-91a5-5cd9-9c44-e9e2a2dbb76f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:b88d4a89-29d8-52f7-84bd-9fd09574443d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:819cd57e-fb04-50bc-864d-5687090e40dd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 7.2.0-tuxcare.4 of @angular/platform-server. not_affected \u2014 Angular version 7.2.0 is not affected by CVE-2026-88056. The vulnerability requires the presence of a `parseUrl` function in `packages/platform-server/src/url.ts` that uses `String.prototype.trim()` to normalize URLs, which strips Unicode whitespace and can convert validated same-origin relative URLs into cross-origin protocol-relative URLs. Version 7.2.0 does not contain the `url.ts` file; it ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:de06e6e3-78a5-5e78-8cd0-d7f2e6814ac4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:688b8863-f930-5a28-8363-aa9ef200fe17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:b11eff36-aeb8-5a8a-a34b-46cf1f017996", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 7.2.0-tuxcare.4 of @angular/platform-server. not_affected \u2014 Angular v7.2.0 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache, hierarchical HttpClient delegation (withRequestsMadeViaParent()), and automatic HTTP response caching features that were introduced in Angular v16+. Version 7.2.0 uses NgModule-based configuration (HttpClientModule) with manual TransferState only\u2014no automatic HTTP-to-TransferState caching exists. The...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:6d7fdc75-11bd-51f6-a885-698d9b3dbba2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ] }