{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6b49032f-b9b0-5311-bb52-b4bbe285b6ac",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/common",
      "purl": "pkg:npm/%40angular/common@5.1.2-tuxcare.8",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.8",
      "version": "5.1.2-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/common",
            "purl": "pkg:npm/%40angular/common@5.1.2",
            "type": "library",
            "version": "5.1.2"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-66035",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:af6efe0c-b0e8-5353-b1eb-b4cc38af8908",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.1.2-tuxcare.8 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-111753",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:0fdaae7c-bbd3-5281-a8b9-3ada5e19319a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111753 affects version 5.1.2-tuxcare.8 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-50170",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:c23a4c2d-ec51-5457-8e54-4f538006a0d6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-50170 does not affect version 5.1.2-tuxcare.8 of @angular/common. not_affected \u2014 no evidence captured",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-50171",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:bac14226-9ebe-59dd-a7b8-c2587b1a4014",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.1.2-tuxcare.8 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-54266",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:180cfd3e-2eff-5eb4-bee8-ae234de9e1d1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54266 does not affect version 5.1.2-tuxcare.8 of @angular/common. not_affected \u2014 Angular 5.1.2 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature that generates cache keys using a weak 32-bit DJB2 hash does not exist in this version. This feature was introduced in Angular v16+, while the target is v5.1.2. Although TransferState exists in this version for basic state transfer, there is no integration with HttpClient for automatic response caching, no...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-54268",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:0e488639-3ede-5f57-9392-d59f44b01c9d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.1.2-tuxcare.8 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-68945",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:2fe4cffe-8074-5fa9-9472-c1a31bfa07b7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-68945 does not affect version 5.1.2-tuxcare.8 of @angular/common. not_affected \u2014 Angular 5.1.2 is not affected by CVE-2026-68945. The vulnerable component HttpTransferCache does not exist in this version. HttpTransferCache was introduced in Angular v16 (circa 2022), while this target is Angular 5.1.2 (2017-2018 era). Although Angular 5.1.2 has TransferState for basic SSR state transfer and HttpClient with HttpParams, it lacks the HTTP response caching mechanism during SSR t...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88059",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:3c11b45f-2c72-5f9f-8aa2-fcf4f2b60a9f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88059 does not affect version 5.1.2-tuxcare.8 of @angular/common. not_affected \u2014 CVE-2026-88059 affects Angular's HttpTransferCache utility when used with hierarchical HttpClient configuration (withRequestsMadeViaParent()) during SSR and hydration. These features were introduced in Angular v16. The target version (5.1.2) does not contain HttpTransferCache, withRequestsMadeViaParent(), or the hydration features required for this vulnerability. TuxCare's own patch analyses fo...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/common@5.1.2-tuxcare.8"
    }
  ]
}