{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:479e6fbd-afe1-5b4e-b21b-47df7a5b7399",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/common",
      "purl": "pkg:npm/%40angular/common@14.3.0-tuxcare.13",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/common@14.3.0-tuxcare.13",
      "version": "14.3.0-tuxcare.13",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/common",
            "purl": "pkg:npm/%40angular/common@14.3.0",
            "type": "library",
            "version": "14.3.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-66035",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@14.3.0-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:e5d505e4-678c-5a5c-90d3-54fc83d5cbd1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66035 is fixed in version 14.3.0-tuxcare.13 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-111753",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@14.3.0-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:86907707-bd60-55ca-a133-94a45c4e096c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111753 affects version 14.3.0-tuxcare.13 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-50170",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@14.3.0-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:b7c5a21f-c98a-55e6-bc55-cfaf1b399361",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50170 is fixed in version 14.3.0-tuxcare.13 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-50171",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@14.3.0-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:205388ce-8f2f-5e40-b129-e132aba86418",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50171 is fixed in version 14.3.0-tuxcare.13 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-54266",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@14.3.0-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:5304d7db-d414-51c9-b97f-db131d89c79e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54266 is fixed in version 14.3.0-tuxcare.13 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-54268",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@14.3.0-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:75a7c321-4037-5fd8-b05c-8e835b1f28ea",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54268 is fixed in version 14.3.0-tuxcare.13 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-68945",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@14.3.0-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:9ee63509-75cb-5da9-8928-47fa5ad71eae",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-68945 does not affect version 14.3.0-tuxcare.13 of @angular/common. not_affected \u2014 Angular v14.3.0 is not affected by CVE-2026-68945. The vulnerable HttpTransferCache feature does not exist in this version\u2014it was introduced in Angular v16.0.0, two major versions later. Without HttpTransferCache, there is no code path that can generate ambiguous cache keys from repeated HTTP parameters. This finding is consistent with two prior TuxCare analyses (CVE-2026-54266, CVE-2026-50170)...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88059",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@14.3.0-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:938968b9-4dc6-5a5d-9b57-75b069b486d3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88059 does not affect version 14.3.0-tuxcare.13 of @angular/common. not_affected \u2014 Version 14.3.0 is not affected by CVE-2026-88059. The vulnerable features (HttpTransferCache interceptor, withRequestsMadeViaParent() for hierarchical HttpClient configuration, and provideClientHydration() for SSR hydration) do not exist in this version. These features were introduced in Angular v16.0.0, while the target is v14.3.0 (two major versions earlier). Patch files CVE-2026-50170.patch ...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/common@14.3.0-tuxcare.13"
    }
  ]
}