{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:5b1147ee-3a70-56e8-b6ee-174698be5d38",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/compiler",
      "purl": "pkg:npm/%40angular/compiler@5.2.7-tuxcare.8",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/compiler@5.2.7-tuxcare.8",
      "version": "5.2.7-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/compiler",
            "purl": "pkg:npm/%40angular/compiler@5.2.7",
            "type": "library",
            "version": "5.2.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-66412",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler@5.2.7-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:45d222da-f1c0-593d-849a-7645574b5771",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.2.7-tuxcare.8 of @angular/compiler."
      }
    },
    {
      "id": "CVE-2026-22610",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler@5.2.7-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:521278ce-b3b3-5655-a3c3-442ad2060617",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.7-tuxcare.8 of @angular/compiler."
      }
    },
    {
      "id": "CVE-2026-32635",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler@5.2.7-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:2c377d3a-42dd-5fa1-8a28-7cd3caf7c22b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-32635 affects version 5.2.7-tuxcare.8 of @angular/compiler."
      }
    },
    {
      "id": "CVE-2026-50557",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler@5.2.7-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:6048dec2-1b29-56c0-ad0c-987ae5e7ed3a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.2.7-tuxcare.8 of @angular/compiler."
      }
    },
    {
      "id": "CVE-2026-54265",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler@5.2.7-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:a93b8e89-204b-5d39-89b4-c62c4df0573c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54265 does not affect version 5.2.7-tuxcare.8 of @angular/compiler. not_affected \u2014 Angular 5.2.7-tuxcare.2 uses the View Engine compiler architecture, which does not have the vulnerable TwoWayProperty operation present in Ivy. Two-way bindings desugar through the same parsePropertyBinding() code path as one-way bindings and receive identical schema-derived sanitization. The vulnerability requires the Ivy template compiler pipeline with resolve_sanitizers.ts missing the TwoWay...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-69151",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler@5.2.7-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:379078c6-eff0-5666-9906-2a7a6644a9a2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-69151 is fixed in version 5.2.7-tuxcare.8 of @angular/compiler."
      }
    },
    {
      "id": "CVE-2026-88057",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/compiler@5.2.7-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:aa577be9-7d1d-5aaf-9816-6e7526efda13",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88057 does not affect version 5.2.7-tuxcare.8 of @angular/compiler. not_affected \u2014 Angular 5.2.7 is not affected by CVE-2026-88057. The vulnerability pattern described in the CVE (compiler using directive selector instead of concrete host element for SecurityContext determination in host bindings) does not exist in this version. Angular 5.2.7 correctly uses the element name when determining SecurityContext for directive host bindings, as evidenced in template_parser.ts and bi...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/compiler@5.2.7-tuxcare.8"
    }
  ]
}