{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:eb538a15-6018-5869-97b0-cb5127fcd18f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/platform-server",
      "purl": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.7",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.7",
      "version": "13.3.0-tuxcare.7",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/platform-server",
            "purl": "pkg:npm/%40angular/platform-server@13.3.0",
            "type": "library",
            "version": "13.3.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-59052",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:d747a5e7-6117-58d6-a416-5002482442a0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-59052 affects version 13.3.0-tuxcare.7 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-101895",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:29a592fa-c7e4-53d9-9844-2acd4d2265f5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-101895 is fixed in version 13.3.0-tuxcare.7 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-111754",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:a24d7533-4fc2-56b6-9249-4cd247f6c153",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111754 affects version 13.3.0-tuxcare.7 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-41423",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:39971c48-984f-5f0f-901c-f0dd43977bdf",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41423 does not affect version 13.3.0-tuxcare.7 of @angular/platform-server. not_affected \u2014 The target repository (Angular 13.3.0-tuxcare.1) is NOT AFFECTED by CVE-2026-41423. While the target lacks the explicit sanitization that the upstream patch adds, it uses a fundamentally different URL parsing mechanism (Node's url.parse() without base URL) that does not extract hostnames from protocol-relative URLs. The architectural difference prevents the SSRF attack vector from succeeding.",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-46417",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:d698001d-a13e-5950-92d3-7a2c178b7282",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-46417 is fixed in version 13.3.0-tuxcare.7 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-50168",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:c3be9bb7-bd55-558a-ad8a-161d197d9b85",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50168 is fixed in version 13.3.0-tuxcare.7 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-50555",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:fc7ce76a-1c34-5320-bb59-244934679239",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50555 is fixed in version 13.3.0-tuxcare.7 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-50556",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:b4322629-735b-5e58-a296-1afd53e7c86c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50556 is fixed in version 13.3.0-tuxcare.7 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-69149",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:916d6d6c-6dc3-5a7d-afb1-b786ed1a190c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-69149 is fixed in version 13.3.0-tuxcare.7 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-88056",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:49bab641-4243-5d70-a2cb-146192284f21",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88056 does not affect version 13.3.0-tuxcare.7 of @angular/platform-server. not_affected \u2014 Angular 13.3.0-tuxcare.4 is not affected by CVE-2026-88056. The vulnerability involves using String.prototype.trim() on URL strings to strip Unicode whitespace, which converts validated same-origin URLs into cross-origin protocol-relative URLs, enabling SSRF and credential leakage. This vulnerable code pattern was introduced in Angular versions AFTER 13.3.0 (likely v14+) and was fixed in v20.3....",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88058",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:d5d78263-138a-52c2-921a-58f446034e5d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-88058 is fixed in version 13.3.0-tuxcare.7 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-88060",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:0205a93f-0d5c-5c87-a0a9-8aa2f310892e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-88060 is fixed in version 13.3.0-tuxcare.7 of @angular/platform-server."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/platform-server@13.3.0-tuxcare.7"
    }
  ]
}