{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fc160dcc-ce2a-5fe2-b0a6-b062e99fe89c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1", "version": "16.2.11-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:763ab04b-cfbf-545f-a00e-1e2bfbe92ce3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:c2842344-1224-592d-90bf-3ee5526c18dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:492356a9-963e-5690-acc3-ffc614a4830e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:eafdfc3e-7f98-5d01-8a61-50b5b57c5c3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:f20dca86-a197-5080-8c5a-8a1217f81e06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:43ff6d0c-f739-5ff2-bd68-37d7ac04870e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:ef6ee6c2-c88d-577a-83dc-0e3c4b84de36", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:b4fe64ac-d7d1-590b-866a-aa8b81348dc1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:f63ce4c9-fc5b-5c3a-b5ff-146f2f14eb2a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:b2a61f86-cf09-5005-9cb4-275146f06d05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:707b1920-6311-5007-99cd-60c22c305cce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:a5c694c7-bc5e-5dc4-9e58-a1d985af6102", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:d1a2a769-839e-5379-b7f6-5fb0c0119942", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:def02c90-4359-50ac-a890-c9125967e17e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:2a59dea2-d3ea-574d-a8be-1743088efecc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:07c72b44-2bf3-521e-a964-efe1f8a74b4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:a5f64d04-c4ee-5e2f-aca2-a599cf61e52d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:abefa254-2172-5c9c-ada9-14e5f9056143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:19da993e-fdf3-5a2f-b30d-f46acc0f04d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:8a44d382-47f7-54aa-a02c-d6b40680ec50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:49022c2a-7632-5c37-b4b1-1bdca16bee91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:695a5b25-c656-5471-82da-bbf52a1da28a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 16.2.11-tuxcare.1 of @angular/platform-server, and is fixed in 16.2.11-tuxcare.2." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:3cc23ffd-2a8f-566f-8f7e-1d772d5f92dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 16.2.11-tuxcare.1 of @angular/platform-server, and is fixed in 16.2.11-tuxcare.2." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:df2013e4-2a23-50bf-97bd-9d1439812587", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 16.2.11-tuxcare.1 of @angular/platform-server, and is fixed in 16.2.11-tuxcare.2." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:41b2caa4-8c5e-518b-ac9a-425184acce2a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.1 of @angular/platform-server. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:34544172-ba42-5da0-999a-e15764b26b49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.11-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:b6fdc1ad-13e1-5136-bbea-07dc18f98dd8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.11-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ], "bom-ref": "urn:uuid:28142681-180d-5094-a434-f79303609f2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.11-tuxcare.1 of @angular/platform-server." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.1" } ] }