{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:767ee343-eafc-5117-83f2-7b6b0bd8884f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/common",
      "purl": "pkg:npm/%40angular/common@15.2.2-tuxcare.7",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/common@15.2.2-tuxcare.7",
      "version": "15.2.2-tuxcare.7",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/common",
            "purl": "pkg:npm/%40angular/common@15.2.2",
            "type": "library",
            "version": "15.2.2"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-66035",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.2-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:5b5d3f3d-1417-5057-9ee1-56b6067ce87a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.2.2-tuxcare.7 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-111753",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.2-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:812303a9-ac26-5c79-b49f-f3edb16761c7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111753 affects version 15.2.2-tuxcare.7 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-50170",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.2-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:ba194487-22df-533f-b1dd-8b6a2a959189",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.2-tuxcare.7 of @angular/common. not_affected \u2014 Angular v15.2.2 is not affected by CVE-2026-50170. The HTTP TransferCache feature, which is the subject of the vulnerability, was introduced in Angular v16.0.0 (March 2023). The target repository version (15.2.2-tuxcare.1) predates this feature entirely and does not contain the vulnerable code path.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-50171",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.2-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:0314bfa3-6e8b-52cb-b201-b1aa56b5b2a4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.2.2-tuxcare.7 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-54266",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.2-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:b5c778f9-fbba-5504-bf82-5604e631b5a5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.2-tuxcare.7 of @angular/common. not_affected \u2014 Angular 15.2.2 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature was introduced in Angular 16.0.0 (May 2023), after this version was released (March 2023). The target codebase does not contain the transfer_cache.ts module, HttpTransferCache API, or any HTTP response caching mechanism that uses hash-based cache keys.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-54268",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.2-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:55ad2645-10b0-5b34-b728-d79599a2b125",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.2.2-tuxcare.7 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-68945",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.2-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:725bcf4d-1a96-5b99-812a-833b458a2966",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-68945 does not affect version 15.2.2-tuxcare.7 of @angular/common. not_affected \u2014 Angular 15.2.2-tuxcare.2 is not affected by CVE-2026-68945. The vulnerable HttpTransferCache feature does not exist in this version\u2014it was introduced in Angular 16.0.0, after the target's release. Without HttpTransferCache, the cache-key collision vulnerability described in the CVE (where repeated HTTP parameters like `role=user&role=admin` collide with scalar-comma parameters like `role=user,a...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88059",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.2-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:1e70aa32-621b-5317-9583-468b75dac6b3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88059 does not affect version 15.2.2-tuxcare.7 of @angular/common. not_affected \u2014 Angular 15.2.2 is not affected by CVE-2026-88059. The vulnerability requires the HttpTransferCache feature, which was introduced in Angular v16.0.0. Angular 15.2.2 does not contain HttpTransferCache, provideClientHydration, withHttpTransferCacheOptions, or any SSR transfer cache infrastructure. While withRequestsMadeViaParent() exists in v15.2.2, it cannot trigger the vulnerability without the ...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/common@15.2.2-tuxcare.7"
    }
  ]
}