{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:9dcd9d6e-3789-55c2-bba9-2b1fcc12644b",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/platform-server",
      "purl": "pkg:npm/%40angular/platform-server@11.2.14-tuxcare.12",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/platform-server@11.2.14-tuxcare.12",
      "version": "11.2.14-tuxcare.12",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/platform-server",
            "purl": "pkg:npm/%40angular/platform-server@11.2.14",
            "type": "library",
            "version": "11.2.14"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-59052",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@11.2.14-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:e45ef4a5-47df-511b-91a2-b3741029cb72",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-59052 affects version 11.2.14-tuxcare.12 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-101895",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@11.2.14-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:82ba922e-30c9-58a5-8bd6-1a4d788e056b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-101895 is fixed in version 11.2.14-tuxcare.12 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-111754",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@11.2.14-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:3cdac854-ce7b-5c76-acd5-4acd342a5976",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111754 affects version 11.2.14-tuxcare.12 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-46417",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@11.2.14-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:79d78195-74f9-5e50-9e01-e134eeb783cd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-46417 is fixed in version 11.2.14-tuxcare.12 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-50168",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@11.2.14-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:1e459f3c-548e-5b0f-8d8c-73d655fed399",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50168 is fixed in version 11.2.14-tuxcare.12 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-50555",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@11.2.14-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:a6c2cb0a-a021-5c08-86a9-28743140c964",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50555 is fixed in version 11.2.14-tuxcare.12 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-50556",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@11.2.14-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:2e771cee-75b1-5ab5-b759-c14efcb2fe32",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50556 is fixed in version 11.2.14-tuxcare.12 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-69149",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@11.2.14-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:46279a78-689d-5c1c-8c82-68abb9f5f547",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-69149 is fixed in version 11.2.14-tuxcare.12 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-88056",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@11.2.14-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:5b038429-7d22-550c-a718-b373eba24c95",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88056 does not affect version 11.2.14-tuxcare.12 of @angular/platform-server. not_affected \u2014 Angular 11.2.14 is NOT AFFECTED by CVE-2026-88056. The vulnerability requires .trim() to be called on URLs during server-side rendering, creating a discrepancy between WHATWG URL validation and Angular's URL resolution. This discrepancy allows attackers to bypass same-origin checks using Unicode whitespace characters (U+00A0, U+FEFF). However, the vulnerable code pattern (relativeUrlsTransforme...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88058",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@11.2.14-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:48d5e44d-61e4-5b3d-92ff-a65e49e449ed",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-88058 is fixed in version 11.2.14-tuxcare.12 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-88060",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@11.2.14-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:e6331dae-9f9c-514b-ab9a-6469f7b51cb0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-88060 is fixed in version 11.2.14-tuxcare.12 of @angular/platform-server."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/platform-server@11.2.14-tuxcare.12"
    }
  ]
}