{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:65aaabc0-6bb6-5031-b0a3-77ee1543371c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3", "version": "16.2.11-tuxcare.3", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:4f8f0325-cbb9-5214-b33f-211ed861f80c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.3 of @angular/platform-server." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:ce022d67-ffcd-51f5-9ab9-e1d51a764d28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-server." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:9b0bbcf9-2468-5eb3-b4e6-bf8afe0bdae8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-server." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:f14ffda6-cd72-513a-ae0e-515a3077d4af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-server." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:03e46213-5cfe-54fd-b20d-136038608bbe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-server." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:7ae1e4e4-9707-514b-bae4-3fdfd68cb7e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-server." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:f9bf6559-96cc-5e1d-9ffa-691541676427", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:14c9a63a-ad2f-59cb-b0d0-d185e502fb90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-server." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:6276e52b-4ee7-591a-8606-bce2318feff9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-server." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:5662a794-2182-5858-bffb-f156adfb4d63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-server." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:946b1b9c-cd77-5a67-b6a5-66fc080b4aac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-server." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:6911b5c8-8b0c-5387-bf4f-d98b302fefec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:94136104-2d79-5b38-bd3f-db708a1a5fe8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-server." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:e0f35be7-cdf0-5015-a5ee-c54ee2ff82fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-server." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:3ba69596-b6ed-5e19-888e-74eadf580883", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-server." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:ac097604-abf2-5847-be9a-fa3ed08bda14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-server." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:757e79e8-6842-5426-9ec3-805f9fc434dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-server." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:7a1df7ec-b216-59b5-b10d-2634c6dc77b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-server." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:65fd2027-c3d0-54a5-9ad8-3197f60600b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-server." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:1fa3d4eb-2218-5229-9b22-ec1e5b3071f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-server." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:93a4019d-4090-5cd8-a71d-5e7c01fa1181", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-server." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:52c7aa3d-ba24-5bab-b8e1-2e75ff9fde10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-server." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:4a7f9db4-de3e-5e48-912f-59503c604d24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-server." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:3cae557a-5d54-57c2-9995-c3a481240cd8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.3 of @angular/platform-server." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:abc22f85-698a-5ed6-836c-f31b932d6157", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.3 of @angular/platform-server. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:2169c2c9-2e8a-5552-99a7-ec98797c9f74", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 16.2.11-tuxcare.3 of @angular/platform-server." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:90eda96e-7718-5b9c-8199-01c4c18fe54c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 16.2.11-tuxcare.3 of @angular/platform-server." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ], "bom-ref": "urn:uuid:3b8e21fc-fec6-5ac1-a88e-ab74f19a80ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 16.2.11-tuxcare.3 of @angular/platform-server." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@16.2.11-tuxcare.3" } ] }