{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:33facc7c-4f6f-5916-a8bb-0e82350d33a7",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/common",
      "purl": "pkg:npm/%40angular/common@15.2.6-tuxcare.6",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/common@15.2.6-tuxcare.6",
      "version": "15.2.6-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/common",
            "purl": "pkg:npm/%40angular/common@15.2.6",
            "type": "library",
            "version": "15.2.6"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-66035",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.6-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:358696ed-9334-55df-894a-2e48eb381d91",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.2.6-tuxcare.6 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-111753",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.6-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:427eca4f-6a2d-5175-8605-53e56a9d1719",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111753 affects version 15.2.6-tuxcare.6 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-50170",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.6-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:ebd5f4ed-997f-5e52-9700-f020026f79a3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.6-tuxcare.6 of @angular/common. not_affected \u2014 Angular version 15.2.6-tuxcare.1 does not contain the HttpTransferCache feature that is the subject of CVE-2026-50170. The vulnerable component (packages/common/http/src/transfer_cache.ts) was introduced in Angular v16.0.0-next.7, after the target version. The vulnerability requires automatic HTTP response caching in TransferState during SSR, which does not exist in v15.2.6.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-50171",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.6-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:c9cdb939-0014-5ae4-85b7-9dff7c79fbbd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.2.6-tuxcare.6 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-54266",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.6-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:57396af4-979d-57c6-a6a3-c910a6f02dc6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.6-tuxcare.6 of @angular/common. not_affected \u2014 Angular 15.2.6-tuxcare.1 is not affected by CVE-2026-54266 because the HttpTransferCache feature, including the vulnerable weak DJB2 hash function, was not introduced until Angular v16.0.0. The target version predates the introduction of this feature entirely.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-54268",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.6-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:1105974b-1e24-548c-93e0-38a938f67105",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.2.6-tuxcare.6 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-68945",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.6-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:57e69e81-b4e0-50d8-b245-763f9d165b5c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-68945 does not affect version 15.2.6-tuxcare.6 of @angular/common. not_affected \u2014 Angular 15.2.6 is not affected by CVE-2026-68945. The vulnerable HttpTransferCache feature does not exist in this version. HttpTransferCache was introduced in Angular v16.0.0 (commit aff1512950, March 31, 2023) and first released on May 3, 2023. The target version 15.2.6 was released on April 5, 2023 and predates the feature. Verified by: (1) git ancestry check confirms the feature commit is NO...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-88059",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.6-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:3f2840f1-91b2-53e5-9a64-0f26be0b0193",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88059 does not affect version 15.2.6-tuxcare.6 of @angular/common. not_affected \u2014 Angular version 15.2.6 is not affected by CVE-2026-88059. The vulnerability requires the HttpTransferCache feature, which was introduced in version 16.1.0-next.0 (released after v15.2.6) and does not exist in the target codebase. The automated HTTP request caching mechanism that enables the vulnerability is absent from version 15.2.6.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/common@15.2.6-tuxcare.6"
    }
  ]
}