{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:48a01c56-b767-5165-b543-5009064c55d2",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/common",
      "purl": "pkg:npm/%40angular/common@4.4.7-tuxcare.13",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/common@4.4.7-tuxcare.13",
      "version": "4.4.7-tuxcare.13",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/common",
            "purl": "pkg:npm/%40angular/common@4.4.7",
            "type": "library",
            "version": "4.4.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-66035",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:1484bade-e84f-594f-bd9f-845fde8614f1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66035 is fixed in version 4.4.7-tuxcare.13 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-111753",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:df130bf0-3614-586c-b45e-0f34bd6ed63d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111753 affects version 4.4.7-tuxcare.13 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-50170",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:d480be5b-c6ad-5850-998b-52f86a14b164",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50170 is fixed in version 4.4.7-tuxcare.13 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-50171",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:eb3922eb-92df-5398-b7fd-07ab79cb1770",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50171 is fixed in version 4.4.7-tuxcare.13 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-54266",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:d0476a37-d2ea-5cb0-b36f-120435016aa7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54266 is fixed in version 4.4.7-tuxcare.13 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-54268",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:1a41490a-f54b-52b3-abf3-d5aac9b0d6b0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54268 is fixed in version 4.4.7-tuxcare.13 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-68945",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:8837155c-ba70-5ee2-95d0-b6098ac8424a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-68945 does not affect version 4.4.7-tuxcare.13 of @angular/common. not_affected \u2014 Angular 4.4.7 is NOT AFFECTED by CVE-2026-68945. The vulnerable component (HttpTransferCache) does not exist in this version. HttpTransferCache was introduced in Angular v16 alongside the hydration feature, while this target is version 4.4.7 \u2014 predating the feature by 12+ major versions. Without HttpTransferCache, the cache key ambiguity vulnerability cannot manifest, as there is no SSR-to-clie...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88059",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:f0c3663a-a199-515b-86d6-710f9de1d5ad",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88059 does not affect version 4.4.7-tuxcare.13 of @angular/common. not_affected \u2014 Angular 4.4.7 is not affected by CVE-2026-88059. The vulnerability requires HttpTransferCache, TransferState, hydration support, and hierarchical HttpClient configuration (withRequestsMadeViaParent()), none of which exist in this version. TransferState, the core mechanism for serializing HTTP responses into server-rendered HTML, was not introduced until a later Angular version (post-v4). The vu...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/common@4.4.7-tuxcare.13"
    }
  ]
}