{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:75d7c22d-9180-5357-b24d-e640078aa6db",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/platform-server",
      "purl": "pkg:npm/%40angular/platform-server@7.2.11-tuxcare.6",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/platform-server@7.2.11-tuxcare.6",
      "version": "7.2.11-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/platform-server",
            "purl": "pkg:npm/%40angular/platform-server@7.2.11",
            "type": "library",
            "version": "7.2.11"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-59052",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@7.2.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:d316b96a-de62-558e-875a-a5ce3799310c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-59052 affects version 7.2.11-tuxcare.6 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-101895",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@7.2.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:7fed2d19-d6da-59b3-834c-246316a1bc1b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-101895 is fixed in version 7.2.11-tuxcare.6 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-111754",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@7.2.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:86360cb2-9b68-55f2-a95c-253c4e7879bf",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111754 affects version 7.2.11-tuxcare.6 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-41423",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@7.2.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:7b6ffed3-8cf0-5673-bc46-c3cc12fc00bf",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41423 is fixed in version 7.2.11-tuxcare.6 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-46417",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@7.2.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:478ac5a4-93a7-54a4-9cf6-e0b644e57c3a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-46417 is fixed in version 7.2.11-tuxcare.6 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-50168",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@7.2.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:79edb68c-7464-5940-82b0-5dae53100e0c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-50168 does not affect version 7.2.11-tuxcare.6 of @angular/platform-server. not_affected \u2014 CVE-2026-50168 addresses vulnerabilities in the WHATWG URL-based parseUrl implementation and allowedHosts validation feature introduced in Angular's CVE-2026-41423 fix. The target (v7.2.11) uses a completely different architecture with Node.js legacy url.parse() and does not have the allowedHosts feature. The specific vulnerable code patterns that CVE-2026-50168 patches do not exist in this ver...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-50555",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@7.2.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:664cd906-cde1-5d0b-acf9-a6697e97c24a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50555 is fixed in version 7.2.11-tuxcare.6 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-50556",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@7.2.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:2bc3242c-d3b6-5982-9a3e-37a909952f8c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50556 is fixed in version 7.2.11-tuxcare.6 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-69149",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@7.2.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:43931fe2-d228-5646-8835-7219c3b4b633",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-69149 is fixed in version 7.2.11-tuxcare.6 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-88056",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@7.2.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:3b0a627b-030b-5bb8-a17d-1b55689b45f8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88056 does not affect version 7.2.11-tuxcare.6 of @angular/platform-server. not_affected \u2014 Angular 7.2.11 is not affected by CVE-2026-88056. The vulnerability requires calling String.prototype.trim() on URL strings before WHATWG URL parsing, creating a discrepancy that enables SSRF. This vulnerable code pattern was introduced in Angular 14+ with a new url.ts file containing parseUrl() that called .trim(). Angular 7.2.11 uses a different parseUrl() implementation in location.ts that d...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88058",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@7.2.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:df0f1437-eb63-51cb-86ed-44fa22c19652",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-88058 is fixed in version 7.2.11-tuxcare.6 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-88060",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@7.2.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:4d1df45b-833e-57d0-af24-8b458a08c1a7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-88060 is fixed in version 7.2.11-tuxcare.6 of @angular/platform-server."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/platform-server@7.2.11-tuxcare.6"
    }
  ]
}