{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0fc327e6-b27c-5c3f-8901-9635f2a004b9",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/common",
      "purl": "pkg:npm/%40angular/common@15.0.3-tuxcare.8",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/common@15.0.3-tuxcare.8",
      "version": "15.0.3-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/common",
            "purl": "pkg:npm/%40angular/common@15.0.3",
            "type": "library",
            "version": "15.0.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-66035",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:f9f7d796-d010-506a-abb4-dac42f7e478d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.0.3-tuxcare.8 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-111753",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:92d5e616-b7f2-5796-875b-a23e3a1d63ba",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111753 affects version 15.0.3-tuxcare.8 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-50170",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:d10c0bdb-94f8-5e48-9cc9-cf7bec9cc41d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-50170 does not affect version 15.0.3-tuxcare.8 of @angular/common. not_affected \u2014 Angular 15.0.3-tuxcare.1 is NOT affected by CVE-2026-50170. The HTTP TransferCache feature that is vulnerable in later Angular versions (v16+) does not exist in this version. The vulnerable code (transfer_cache.ts, hasAuthHeaders(), shouldCacheRequest(), withHttpTransferCache, provideClientHydration) is absent from Angular 15.0.3.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-50171",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:e7f1815b-ca82-51b6-8fe4-9a93ac1f5960",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.0.3-tuxcare.8 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-54266",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:102652cf-aa7a-5300-af40-86a7c7a6afd4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54266 does not affect version 15.0.3-tuxcare.8 of @angular/common. not_affected \u2014 Angular v15.0.3-tuxcare.1 is NOT affected by CVE-2026-54266. The vulnerable HttpTransferCache feature with weak DJB2 hash-based cache keys does not exist in this version. This feature was introduced in Angular v16+. The target has no code path from HTTP request handling to the vulnerability's cache poisoning goal.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-54268",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:5019c042-b614-5c4b-9b59-ea7559e28e72",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.0.3-tuxcare.8 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-68945",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:496e274a-48ec-593f-8cdc-8d1a86e1631c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-68945 does not affect version 15.0.3-tuxcare.8 of @angular/common. not_affected \u2014 Angular 15.0.3 is not affected by CVE-2026-68945. The vulnerable HttpTransferCache feature for SSR HTTP request caching does not exist in this version. HttpTransferCache was introduced in Angular v16.0.0 (commit aff1512950, March 31, 2023) and the target version predates this feature entirely. Without HttpTransferCache, there is no cache key generation logic that could exhibit the comma-joining...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88059",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:23628d32-356f-5858-9cf8-d9992821bff4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88059 does not affect version 15.0.3-tuxcare.8 of @angular/common. not_affected \u2014 Angular 15.0.3 is NOT AFFECTED by CVE-2026-88059. The vulnerability exists in the HttpTransferCache utility when used with SSR hydration and hierarchical HttpClient delegation (withRequestsMadeViaParent). However, HttpTransferCache was not introduced until Angular 16.0.0 (March 31, 2023), approximately 4 months after Angular 15.0.3's release. The vulnerable component does not exist in this vers...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/common@15.0.3-tuxcare.8"
    }
  ]
}