{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0143d2ec-f49a-5f57-b5f3-6d0945434d83",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/common",
      "purl": "pkg:npm/%40angular/common@15.2.10-tuxcare.16",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/common@15.2.10-tuxcare.16",
      "version": "15.2.10-tuxcare.16",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/common",
            "purl": "pkg:npm/%40angular/common@15.2.10",
            "type": "library",
            "version": "15.2.10"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-66035",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.10-tuxcare.16"
        }
      ],
      "bom-ref": "urn:uuid:8c68dccb-3f43-5b51-9755-cbb2848bb482",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.2.10-tuxcare.16 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-111753",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.10-tuxcare.16"
        }
      ],
      "bom-ref": "urn:uuid:df431c43-c8af-5b98-8103-fea4acbd7a9f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111753 affects version 15.2.10-tuxcare.16 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-50170",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.10-tuxcare.16"
        }
      ],
      "bom-ref": "urn:uuid:41116a55-228a-5bab-9376-af3785f9f29e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50170 is fixed in version 15.2.10-tuxcare.16 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-50171",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.10-tuxcare.16"
        }
      ],
      "bom-ref": "urn:uuid:f0d4a1a9-464e-5da8-9ff8-11e8a6d60918",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.2.10-tuxcare.16 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-54266",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.10-tuxcare.16"
        }
      ],
      "bom-ref": "urn:uuid:b7cd07b5-798c-50fd-9392-0c1e21157329",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.10-tuxcare.16 of @angular/common. not_affected \u2014 Angular 15.2.10-tuxcare.10 does not contain the HttpTransferCache feature. The vulnerable component (transfer_cache.ts) does not exist in this version. HttpTransferCache was introduced in Angular 16.0.0, and this version predates that introduction.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-54268",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.10-tuxcare.16"
        }
      ],
      "bom-ref": "urn:uuid:c844aea5-9dda-58c9-ad2d-e66bb5b02c95",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.2.10-tuxcare.16 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-68945",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.10-tuxcare.16"
        }
      ],
      "bom-ref": "urn:uuid:f6b7e881-194e-5b91-bdd0-19a0357e02a5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-68945 does not affect version 15.2.10-tuxcare.16 of @angular/common. not_affected \u2014 Angular 15.2.10 is NOT AFFECTED by CVE-2026-68945. The vulnerable HttpTransferCache feature does not exist in this version. HttpTransferCache was introduced in Angular v16.0.0, and version 15.2.10 predates this feature entirely. Without HttpTransferCache, there is no automatic HTTP response caching mechanism during SSR, and therefore no cache key generation logic that could produce ambiguous ke...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88059",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.10-tuxcare.16"
        }
      ],
      "bom-ref": "urn:uuid:6ed12269-e873-5d34-a118-21ecf2f0310d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88059 does not affect version 15.2.10-tuxcare.16 of @angular/common. not_affected \u2014 Angular v15.2.10 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires the HttpTransferCache feature (for caching HTTP requests during SSR/hydration), which was introduced in Angular v16.0.0. Version 15.2.10 does not contain this feature - confirmed by: (1) CVE-2026-50170 patch documentation explicitly stating v15.2.10 lacks HttpTransferCache, (2) git history showing the feature was add...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/common@15.2.10-tuxcare.16"
    }
  ]
}