{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3fe52c33-ca43-52f4-8e27-3e3dc56e2f95",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/platform-server",
      "purl": "pkg:npm/%40angular/platform-server@15.2.1-tuxcare.5",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/platform-server@15.2.1-tuxcare.5",
      "version": "15.2.1-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/platform-server",
            "purl": "pkg:npm/%40angular/platform-server@15.2.1",
            "type": "library",
            "version": "15.2.1"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-59052",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@15.2.1-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:826ebcdb-9a24-59b5-8e5a-5eeb94666451",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-59052 affects version 15.2.1-tuxcare.5 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-101895",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@15.2.1-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:574fc139-73b0-5cc3-8c0e-0db8276738ac",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101895 affects version 15.2.1-tuxcare.5 of @angular/platform-server, and is fixed in 15.2.1-tuxcare.6."
      }
    },
    {
      "id": "CVE-2026-111754",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@15.2.1-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:520d2683-89e4-5b4e-bd87-9629b9977839",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111754 affects version 15.2.1-tuxcare.5 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-41423",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@15.2.1-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:cbe189b0-5331-55fd-a325-044c2dfa819c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.1-tuxcare.5 of @angular/platform-server. not_affected \u2014 The target Angular version 15.2.1 uses Node.js url.parse() API which does not exhibit the protocol-relative URL hostname override vulnerability. The vulnerable behavior was introduced in Angular 17+ when the code was refactored to use WHATWG new URL() API. Version 15.2.1 is not affected by CVE-2026-41423.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-46417",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@15.2.1-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:a6c4014d-5e81-55a8-8c1e-d3976bf955a0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.2.1-tuxcare.5 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-50168",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@15.2.1-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:07b1b541-8193-5d6d-aa1c-535b34ffbebf",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50168 is fixed in version 15.2.1-tuxcare.5 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-50555",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@15.2.1-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:8c104fcc-baf1-5aea-a576-95b7362af8d0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.2.1-tuxcare.5 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-50556",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@15.2.1-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:1aea9c9b-88dd-5157-94aa-7e79b1d2dc89",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.2.1-tuxcare.5 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-69149",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@15.2.1-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:1d7d7d4f-562d-5556-bf83-610d21f758ba",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-69149 is fixed in version 15.2.1-tuxcare.5 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-88056",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@15.2.1-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:e4e6ef54-11a0-5023-8fdf-4b5441f6f79f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88056 does not affect version 15.2.1-tuxcare.5 of @angular/platform-server. not_affected \u2014 Version 15.2.1 is not affected by CVE-2026-88056. The vulnerability requires a `String.prototype.trim()` call in the `parseUrl` function that strips Unicode whitespace, creating a discrepancy between WHATWG URL validation and Angular's URL resolution. This vulnerable code pattern was introduced in version 22.1.0 (May 2026) via refactor commit e14d34e9ee and fixed in version 20.3.30 (August 2026...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88058",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@15.2.1-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:0bdd64c6-a88f-5dc7-9452-261b07f09af8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-88058 is fixed in version 15.2.1-tuxcare.5 of @angular/platform-server."
      }
    },
    {
      "id": "CVE-2026-88060",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/platform-server@15.2.1-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:25cb7635-c7b5-504e-bf1e-7ce886bb1f5f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-88060 is fixed in version 15.2.1-tuxcare.5 of @angular/platform-server."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/platform-server@15.2.1-tuxcare.5"
    }
  ]
}