{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:659126b9-e7d5-56f7-bb27-54014ad97254",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/common",
      "purl": "pkg:npm/%40angular/common@10.2.5-tuxcare.12",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/common@10.2.5-tuxcare.12",
      "version": "10.2.5-tuxcare.12",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/common",
            "purl": "pkg:npm/%40angular/common@10.2.5",
            "type": "library",
            "version": "10.2.5"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-66035",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@10.2.5-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:1f80d94e-4ecb-534a-87b5-68acb6ec266f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66035 is fixed in version 10.2.5-tuxcare.12 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-111753",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@10.2.5-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:44e9b6b3-2d4d-5163-8d4f-3d49055ecd6d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111753 affects version 10.2.5-tuxcare.12 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-50170",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@10.2.5-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:8942726b-3222-5573-a003-938ba8078865",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-50170 does not affect version 10.2.5-tuxcare.12 of @angular/common. not_affected \u2014 Angular v10.2.5-tuxcare.7 is NOT AFFECTED by CVE-2026-50170. The HTTP transfer cache feature that contains the vulnerability does not exist in this version. The feature was introduced in Angular v16 (released 2023), while v10.2.5 was released in April 2021.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-50171",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@10.2.5-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:852d1b36-c53c-5038-b58d-b8cbfc1cc6b8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50171 is fixed in version 10.2.5-tuxcare.12 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-54266",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@10.2.5-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:28af80b8-f7e5-571e-b324-0b0b7c053bde",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54266 does not affect version 10.2.5-tuxcare.12 of @angular/common. not_affected \u2014 Angular v10.2.5 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature with weak DJB2 hashing does not exist in this version\u2014it was introduced in Angular v16+. Exhaustive searches confirm the complete absence of transfer_cache.ts, generateHash function, and all HttpTransferCache-related code.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-54268",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@10.2.5-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:5e7364fe-d0d5-5015-b21d-5099a38446ce",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54268 is fixed in version 10.2.5-tuxcare.12 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-68945",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@10.2.5-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:55d29a27-e11a-5e90-af54-f2a7cc052353",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-68945 does not affect version 10.2.5-tuxcare.12 of @angular/common. not_affected \u2014 Angular v10.2.5 is NOT AFFECTED by CVE-2026-68945. The vulnerable HttpTransferCache feature does not exist in this version. HttpTransferCache was introduced in Angular v16, while the target version is 10.2.5. The CVE concerns cache key collision in HttpTransferCache's automatic HTTP request caching during SSR, but v10 lacks both the HttpTransferCache component and the vulnerable cache key gener...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88059",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@10.2.5-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:0b2f0cc5-8ea3-5165-8e90-c60e7c3de3b8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88059 does not affect version 10.2.5-tuxcare.12 of @angular/common. not_affected \u2014 Angular v10.2.5 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent), features introduced in Angular v16. Version 10.2.5 uses the legacy NgModule-based HttpClientModule API and has no HttpTransferCache implementation. While TransferState exists as a low-level primitive, there is no automatic HTTP resp...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/common@10.2.5-tuxcare.12"
    }
  ]
}