{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:5bab1988-c03a-566f-b658-96ae1cdf5fb1",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/common",
      "purl": "pkg:npm/%40angular/common@13.4.0-tuxcare.12",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/common@13.4.0-tuxcare.12",
      "version": "13.4.0-tuxcare.12",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/common",
            "purl": "pkg:npm/%40angular/common@13.4.0",
            "type": "library",
            "version": "13.4.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-66035",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@13.4.0-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:31b84e5f-1d23-5be1-9d95-f51b65c6d2d8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66035 is fixed in version 13.4.0-tuxcare.12 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-111753",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@13.4.0-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:84be4979-eb57-59e4-a967-c7f9b1efb182",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111753 affects version 13.4.0-tuxcare.12 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-50170",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@13.4.0-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:bd4aa6c7-247f-544e-8f06-cb5f02b0d3a4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50170 is fixed in version 13.4.0-tuxcare.12 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-50171",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@13.4.0-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:155314a1-ef9d-5a73-a746-f18399705280",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50171 is fixed in version 13.4.0-tuxcare.12 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-54266",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@13.4.0-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:71666b4b-b557-5a95-aa48-fc87f24c4ea4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54266 is fixed in version 13.4.0-tuxcare.12 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-54268",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@13.4.0-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:c76c9d8e-5d54-5a3c-890a-e574af2a3a6f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54268 is fixed in version 13.4.0-tuxcare.12 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-68945",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@13.4.0-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:e47b51c7-49ad-5f30-92d6-97082bed90e1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-68945 does not affect version 13.4.0-tuxcare.12 of @angular/common. not_affected \u2014 Angular v13.4.0 is NOT AFFECTED by CVE-2026-68945. The HttpTransferCache feature, which is the subject of this vulnerability, was introduced in Angular v16.0.0 and does not exist in v13.4.0. Without HttpTransferCache, the cache key collision vulnerability involving HttpParams serialization cannot occur. This assessment is consistent with two other HttpTransferCache CVEs (CVE-2026-54266 and CVE-...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88059",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@13.4.0-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:a8b19418-7a03-5288-a0a0-11aaf834970e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88059 does not affect version 13.4.0-tuxcare.12 of @angular/common. not_affected \u2014 Angular 13.4.0 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache and hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular 16.0.0. These features do not exist in Angular 13.4.0, making the attack vector impossible. This assessment is consistent with the repository's own documentation of related CVE-2026-50170, wh...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/common@13.4.0-tuxcare.12"
    }
  ]
}