{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:109a5426-7094-5aa8-bb19-9db60ad51ed7", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1", "version": "7.2.0-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:dfbca358-9b20-5164-8225-3abb55abe763", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 7.2.0-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:a09ee2a6-b559-581a-a6a2-78270f395a4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 7.2.0-tuxcare.1 of @angular/platform-server, and is fixed in 7.2.0-tuxcare.2." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:9cd311bc-d851-5b8b-891b-1465df68a20d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 7.2.0-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:be353ea4-d15c-5894-b304-38aa31a7ce12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 7.2.0-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:48a012d9-c48f-5a22-ba43-8b4d4b1c974a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 7.2.0-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:360d986e-5f41-5466-ab6f-8bc85e0ef4cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 7.2.0-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:8b87ddee-c945-58ad-ab4f-1eff158530ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 7.2.0-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:a0a34f83-e33a-5c98-b37c-40f935e78861", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 7.2.0-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:954fee6d-63e6-5caa-8f56-b24e6ab16db5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 7.2.0-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:a9c6d0f4-e73c-54ce-99ac-82aafad50429", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 7.2.0-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:ae1a2631-1011-5d79-907b-a2a6f39119cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 7.2.0-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:a05f5b7e-ea7a-5dc0-a175-99e487405a4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 7.2.0-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:b38e0c63-3550-5e74-a75a-1ca1a7c40ecb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 7.2.0-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:96415b98-4a11-5d0c-821b-0642fbbf5a18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 7.2.0-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:6514f407-1cc9-5831-b45f-6ef4043800af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 7.2.0-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:38bc25ae-acf1-5b99-9f3e-69b39dede5d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 7.2.0-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:d98cfa9f-ea2d-5da2-bcd6-500b7cf55146", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 7.2.0-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:2a929da4-763c-509d-9cfa-52e7af4d475c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 7.2.0-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:82de8d19-3cd0-54ae-b178-e57ffa78b1f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 7.2.0-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:150f7d6c-df62-51e3-844e-76c0ad15e7db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 7.2.0-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:cf56a720-254f-5d24-91d2-111a2e66aa7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 7.2.0-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:95a87e96-10a1-507f-b39d-b0a380ae23f7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 7.2.0-tuxcare.1 of @angular/platform-server. not_affected \u2014 Angular v7.2.0 is NOT AFFECTED by CVE-2026-68945. The vulnerable component (HttpTransferCache) does not exist in this version. According to patch documentation in the repository (CVE-2026-50170.patch, CVE-2026-54266.patch), the HTTP transfer-cache and client hydration features were introduced in Angular v16. Angular v7.2.0 predates this feature by many major versions. Exhaustive searches confir...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:c6634a02-10e5-56bb-8fd5-b48844a255cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 7.2.0-tuxcare.1 of @angular/platform-server, and is fixed in 7.2.0-tuxcare.3." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:98011141-178f-5c5b-841e-1659253ad235", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 7.2.0-tuxcare.1 of @angular/platform-server, and is fixed in 7.2.0-tuxcare.3." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:0ffa4aa7-ad11-58ce-8fa1-c48a9e44bd12", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 7.2.0-tuxcare.1 of @angular/platform-server. not_affected \u2014 Angular version 7.2.0 is not affected by CVE-2026-88056. The vulnerability requires the presence of a `parseUrl` function in `packages/platform-server/src/url.ts` that uses `String.prototype.trim()` to normalize URLs, which strips Unicode whitespace and can convert validated same-origin relative URLs into cross-origin protocol-relative URLs. Version 7.2.0 does not contain the `url.ts` file; it ...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:7c575b53-d7ec-59e9-be33-8e8e68cf4cb5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 7.2.0-tuxcare.1 of @angular/platform-server." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:44ce6cef-10f4-5ffb-98a0-487e8c3006e5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 7.2.0-tuxcare.1 of @angular/platform-server. not_affected \u2014 Angular v7.2.0 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache, hierarchical HttpClient delegation (withRequestsMadeViaParent()), and automatic HTTP response caching features that were introduced in Angular v16+. Version 7.2.0 uses NgModule-based configuration (HttpClientModule) with manual TransferState only\u2014no automatic HTTP-to-TransferState caching exists. The...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ], "bom-ref": "urn:uuid:9e3db293-9f6b-51ce-841d-bce6be21b79e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 7.2.0-tuxcare.1 of @angular/platform-server." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@7.2.0-tuxcare.1" } ] }