{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0a644f11-c572-56b5-b58c-38d51b32862f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/platform-server", "purl": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5", "version": "17.1.0-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:8cebedad-4ed6-5007-b4fe-7295cc359d89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:15c884b5-1560-55d7-b341-91fdb65cae24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:3e6b5837-a305-5dc7-8fea-b72d6a872d41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:d2624857-2dda-57fe-a6f2-406b5591028f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:8553b49e-6910-5330-b525-be896e0680d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:52ae7810-1c6a-5bc8-94bd-6a87cfd2e78d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:dc5f30e8-19c9-5ebd-8046-847a2e3d1ecb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:9e4d7f52-62e5-5305-9990-0ac9ad9b9929", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:cee82434-bc01-5cd6-9cb3-1a01bfc9fd2b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:90728ef0-9a44-5b58-94c0-0b3b418b7442", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:37e0527a-a195-5841-8e82-f7bd2100bd7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:695db18c-dea8-5a86-8a51-43a857d687bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:229e80db-7a8b-5850-9a54-2d648cbad800", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:83d1e399-6391-5e13-ab53-0970c72e1d58", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:391d7591-a1f0-5460-beea-6dd8dcb3526a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:4f5f02f0-b2e9-5fd2-acc3-54463df2c5ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:27519a18-7123-59b3-964f-e5796aac91de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:d4d8894b-1b86-5a74-81ee-bd51131742dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:dbe9b4e8-37a7-5718-b4e4-0521ecfa0a94", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.5 of @angular/platform-server. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized.", "justification": "code_not_present" } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:11977b7d-cb51-5aa0-867e-ad528c081623", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:ac22e3f8-e95c-5cfd-bb5e-4bc2f46f4f28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:d3d569aa-b2b5-5a2d-bd58-3ba1ec171684", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:83c94b3a-caf0-5ad6-99a1-6aa97596fe84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:ca3eab4e-6a15-5a43-9a16-704d3e02aa68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:d7ec664c-88ca-5e4c-900d-15ad45c62065", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 17.1.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:26fe172e-18ae-5ab3-a023-fd2cf14266e5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.1.0-tuxcare.5 of @angular/platform-server. not_affected \u2014 Angular 17.1.0 was never vulnerable to CVE-2026-88056. The vulnerability exists only in newer Angular versions (v18+, v19+, v20+ before fixes) where a url.ts file with a parseUrl function that uses String.prototype.trim() was introduced. Angular 17.1.0 does not have this file in the upstream release. TuxCare created url.ts for their 17.1.0 fork (commit e06d36f339 by ejarocki@cloudlinux.com) but...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:aa2b8959-171b-56a4-9c17-439bf1480daf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.1.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:83aed3b3-1ce1-53cf-9e7a-9bf5e3837929", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.1.0-tuxcare.5 of @angular/platform-server." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ], "bom-ref": "urn:uuid:1574dec2-a5f6-52eb-ace6-f17bdce83cdb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.1.0-tuxcare.5 of @angular/platform-server." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/platform-server@17.1.0-tuxcare.5" } ] }