{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3b7a27d5-87fe-5eaa-89f3-8a3e1c8a0806", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@7.2.1-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@7.2.1-tuxcare.6", "version": "7.2.1-tuxcare.6", "pedigree": { "ancestors": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@7.2.1", "type": "library", "version": "7.2.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:59816c1a-9af4-5e1f-b8a3-d60f44b8dd2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 7.2.1-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:c42da309-eab9-5908-abc8-2ca8caca4581", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 7.2.1-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-111754", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:fb7d70b0-5fd7-5e10-8f5f-e3efe7b5b4c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111754 affects version 7.2.1-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:ebabf243-5dcb-5b0a-b967-3c79d3161027", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 7.2.1-tuxcare.6 of @angular/platform-server. not_affected \u2014 Angular v7.2.1-tuxcare.2 is NOT affected by CVE-2026-41423. The vulnerability requires WHATWG URL parsing with hostname exposure, but this version uses Node.js url.parse() and does not expose hostname/protocol/port properties. The architectural difference between v7.2.1 (legacy url.parse, no hostname tracking) and v8.2.14+ (WHATWG URL, hostname tracking) means the vulnerability pattern does not...", "justification": "code_not_present" } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:1ef431ef-0150-5a09-963b-3210435f4afc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 7.2.1-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:a22ddb50-9b51-5b94-8afd-a5fe6ff660cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 7.2.1-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:e04c0962-4e09-54fb-ab8b-3602ceab8cef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 7.2.1-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:1eb506b2-7e7c-5d41-b490-d4da56a5a7dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 7.2.1-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:741f44ea-8035-5d30-a532-3b5f436f074d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 7.2.1-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:5d02268d-b9f0-5283-816c-42ed1b773aaa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 7.2.1-tuxcare.6 of @angular/platform-server. not_affected \u2014 Angular 7.2.1 is not affected by CVE-2026-88056. The vulnerability was introduced in Angular 22.0.0 (May 2026) when `String.prototype.trim()` was added to URL resolution utilities. Angular 7.2.1 (released ~2019) lacks the vulnerable code pattern entirely: it has no `url.ts` file, no `resolveUrl`/`parseUrl` with trim(), no `relativeUrlsTransformerInterceptorFn` interceptor, and no same-origin va...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:5aac0259-56f3-592b-b186-036efafdcf17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 7.2.1-tuxcare.6 of @angular/platform-server." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.1-tuxcare.6" } ], "bom-ref": "urn:uuid:aded05e9-b9e6-5322-b91b-bcc6581dc70c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88060 does not affect version 7.2.1-tuxcare.6 of @angular/platform-server. not_affected \u2014 CVE-2026-88060 describes an XSS vulnerability in HTML serialization when rendering user input within `