{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:9da17263-bfd8-551f-adf2-6c601e7a2c93",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/common",
      "purl": "pkg:npm/%40angular/common@15.2.9-tuxcare.6",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/common@15.2.9-tuxcare.6",
      "version": "15.2.9-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/common",
            "purl": "pkg:npm/%40angular/common@15.2.9",
            "type": "library",
            "version": "15.2.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-66035",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.9-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:33ecb095-ac71-5170-a50d-b79049a1efc1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.2.9-tuxcare.6 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-111753",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.9-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:85fcb6a7-4292-50a3-8b8e-fed9c0bc4650",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111753 affects version 15.2.9-tuxcare.6 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-50170",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.9-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:c5a45510-df8a-5541-8225-d2f0179052a3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.9-tuxcare.6 of @angular/common. not_affected \u2014 no evidence captured",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-50171",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.9-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:47c5b0d0-ee76-5606-8016-89d699081aed",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.2.9-tuxcare.6 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-54266",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.9-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:3312dd70-9d41-5574-a831-a989f9526877",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.9-tuxcare.6 of @angular/common. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature does not exist in this version - it was introduced in Angular v16+. Without this feature, there is no code that hashes HTTP request properties for cache key generation, so the hash collision vulnerability cannot manifest.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-54268",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.9-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:b22fe41e-97db-5b91-825a-b69d33cc25af",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.2.9-tuxcare.6 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-68945",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.9-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:e7ead8e9-0b99-516d-b15a-1d969e73edec",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-68945 does not affect version 15.2.9-tuxcare.6 of @angular/common. not_affected \u2014 Angular 15.2.9 is not affected by CVE-2026-68945. The vulnerability exists in the HttpTransferCache feature used during Server-Side Rendering (SSR), which generates cache keys from HTTP request parameters. However, this feature was not introduced until Angular 16.0.0. Angular 15.2.9 lacks the entire HttpTransferCache implementation: no transfer_cache.ts file exists, no HttpTransferCache class, ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88059",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@15.2.9-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:9f74de4b-3c22-5acf-b085-9a2af0c8a03a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88059 does not affect version 15.2.9-tuxcare.6 of @angular/common. not_affected \u2014 Angular 15.2.9 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires the HttpTransferCache feature, which caches HTTP responses into TransferState during SSR with hydration. This feature was introduced in Angular 17.0.0 (October 2023), well after Angular 15.2.9 was released (May 2023). The target version lacks the critical components: no transfer_cache.ts file, no provideClientHydration...",
        "justification": "code_not_reachable"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/common@15.2.9-tuxcare.6"
    }
  ]
}