{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b96f5795-fcde-5d74-a2c5-433844e1fb24", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4", "version": "7.2.0-tuxcare.4", "pedigree": { "ancestors": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@7.2.0", "type": "library", "version": "7.2.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:14eebe50-8e40-55cb-b75d-d54485c7f712", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:7aa8c3b6-8e48-5588-ad77-de6cc6ac1556", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 7.2.0-tuxcare.4 of @angular/platform-server, and is fixed in 7.2.0-tuxcare.5." } }, { "id": "CVE-2026-111754", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:3701b297-40fc-56d8-be2f-653316f38938", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-111754 does not affect version 7.2.0-tuxcare.4 of @angular/platform-server. not_affected \u2014 Angular v7.2.0 is not affected by CVE-2026-111754. While the underlying data flaw exists (WHATWG URL normalization converts `/.//evil.test` to pathname `//evil.test` without validation), the exploitation mechanism described in the CVE does not exist in this version. The CVE's attack chain requires `@angular/ssr` to automatically detect URL mismatches and emit HTTP 302 redirects with protocol-re...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:31e88ccb-a58c-5b44-878e-ec40b16bbda6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:1810857e-b629-5d79-b4a2-c2ef69bbba40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:7d590d4a-1b42-542b-bc1e-9d6666393c07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:17122374-9476-594f-aebe-9c2f2fb669d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:13ba467e-1605-5e6f-a278-54c58bb8d68f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:258ef192-91a5-5cd9-9c44-e9e2a2dbb76f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 7.2.0-tuxcare.4 of @angular/platform-server." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:819cd57e-fb04-50bc-864d-5687090e40dd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 7.2.0-tuxcare.4 of @angular/platform-server. not_affected \u2014 Angular version 7.2.0 is not affected by CVE-2026-88056. The vulnerability requires the presence of a `parseUrl` function in `packages/platform-server/src/url.ts` that uses `String.prototype.trim()` to normalize URLs, which strips Unicode whitespace and can convert validated same-origin relative URLs into cross-origin protocol-relative URLs. Version 7.2.0 does not contain the `url.ts` file; it ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:688b8863-f930-5a28-8363-aa9ef200fe17", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88058 affects version 7.2.0-tuxcare.4 of @angular/platform-server, and is fixed in 7.2.0-tuxcare.5." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ], "bom-ref": "urn:uuid:6d7fdc75-11bd-51f6-a885-698d9b3dbba2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 7.2.0-tuxcare.4 of @angular/platform-server, and is fixed in 7.2.0-tuxcare.5." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.4" } ] }