{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:25323db2-0c8a-5f60-b378-f2ec2a54389a",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/common",
      "purl": "pkg:npm/%40angular/common@10.1.0-tuxcare.8",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/common@10.1.0-tuxcare.8",
      "version": "10.1.0-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/common",
            "purl": "pkg:npm/%40angular/common@10.1.0",
            "type": "library",
            "version": "10.1.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-66035",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@10.1.0-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:0f91cef3-83a0-597f-b3e9-6ff16417da16",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66035 is fixed in version 10.1.0-tuxcare.8 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-111753",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@10.1.0-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:c1fa6074-1839-5a68-8167-0475a4fb5ca9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111753 affects version 10.1.0-tuxcare.8 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-50170",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@10.1.0-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:c9794c92-a35b-51c6-892d-f401b974b3c9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-50170 does not affect version 10.1.0-tuxcare.8 of @angular/common. not_affected \u2014 Angular v10.1.0-tuxcare.2 is not affected by CVE-2026-50170. The vulnerability concerns the HTTP transfer cache feature which caches HTTP responses during server-side rendering (SSR) and replays them during client hydration. This feature was introduced in Angular v16+ and does not exist in v10.1.0. The target version has no transfer_cache.ts file, no transferCacheInterceptorFn, and no HTTP tran...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-50171",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@10.1.0-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:d3663dd7-7863-55f5-80e6-38cf22bc7d39",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50171 is fixed in version 10.1.0-tuxcare.8 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-54266",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@10.1.0-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:9c7e6014-b081-5ceb-a885-c7eac521297e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54266 does not affect version 10.1.0-tuxcare.8 of @angular/common. not_affected \u2014 Angular 10.1.0 does not contain the HttpTransferCache feature. The vulnerability (CVE-2026-54266) is in HttpTransferCache's weak DJB2 hash function used for cache key generation, but this feature was introduced in Angular 16+ and does not exist in version 10.1.0. Type A1 (input absent): the INPUT handler (HttpTransferCache interceptor) is not present anywhere in the codebase.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-54268",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@10.1.0-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:6b3ba7d8-a086-5763-b22f-93be642297e7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54268 is fixed in version 10.1.0-tuxcare.8 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-68945",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@10.1.0-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:89d93fa2-54ee-56cf-8a03-f0fd8320a7a2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-68945 does not affect version 10.1.0-tuxcare.8 of @angular/common. not_affected \u2014 Angular v10.1.0 is not affected by CVE-2026-68945. The vulnerability concerns HttpTransferCache, a feature for caching HTTP requests during Server-Side Rendering (SSR) that was introduced in Angular v16. Version 10.1.0 predates this feature by several years - no transfer_cache.ts file exists in packages/common/http/src/, no HttpTransferCache interceptor is registered in HttpClientModule, and th...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-88059",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@10.1.0-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:417c26b7-60ed-539a-aef5-a87de33dd063",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88059 does not affect version 10.1.0-tuxcare.8 of @angular/common. not_affected \u2014 Angular 10.1.0 is not affected by CVE-2026-88059. The vulnerability requires specific features introduced in Angular v16+: HttpTransferCache (automatic HTTP response caching), provideClientHydration() (SSR hydration API), and withRequestsMadeViaParent() (hierarchical HttpClient delegation). These components do not exist in Angular 10.1.0. While v10 has SSR and TransferState, it lacks the automa...",
        "justification": "code_not_reachable"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/common@10.1.0-tuxcare.8"
    }
  ]
}