{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6d7bebf0-8dcb-53e1-8d89-cf8c3bc4c964",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/core",
      "purl": "pkg:npm/%40angular/core@16.2.7-tuxcare.4",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/core@16.2.7-tuxcare.4",
      "version": "16.2.7-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/core",
            "purl": "pkg:npm/%40angular/core@16.2.7",
            "type": "library",
            "version": "16.2.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-4231",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@16.2.7-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:c5386b04-9f45-5674-a45a-27a1c1a9c550",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-4231 does not affect version 16.2.7-tuxcare.4 of @angular/core. not_affected \u2014 CVE-2021-4231 affects Angular up to 11.0.4/11.1.0-next.2 and was fixed in versions 10.2.5, 11.0.5, and 11.1.0-next.3. The target is Angular 16.2.7-tuxcare.7, which already contains the upstream fix introduced in commit 47d9b6d72dab by Misko Hevery (Angular team). The vulnerability pattern (unescaped HTML comment delimiters allowing XSS via premature comment closure) is not present in this versi...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22610",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@16.2.7-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:9fd213f7-6456-5a0d-a042-5a12b518954d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.7-tuxcare.4 of @angular/core."
      }
    },
    {
      "id": "CVE-2026-27970",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@16.2.7-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:9877395f-64cc-5b8d-9ab1-f57b33e7d58a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.7-tuxcare.4 of @angular/core."
      }
    },
    {
      "id": "CVE-2026-32635",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@16.2.7-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:ce11d60d-cd30-5828-afa4-21a6e909285d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-32635 affects version 16.2.7-tuxcare.4 of @angular/core."
      }
    },
    {
      "id": "CVE-2026-50557",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@16.2.7-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:49e5e61d-1e1e-50d4-8be8-6ca32429944b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.7-tuxcare.4 of @angular/core."
      }
    },
    {
      "id": "CVE-2026-52725",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@16.2.7-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:31b0e970-377e-58fe-807f-68d6b533d2c0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.7-tuxcare.4 of @angular/core."
      }
    },
    {
      "id": "CVE-2026-54267",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@16.2.7-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:1fe4137d-5037-5943-ab0c-7b03c83d59f1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.7-tuxcare.4 of @angular/core."
      }
    },
    {
      "id": "CVE-2026-69151",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@16.2.7-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:5e219b51-2849-5b57-9938-bd937d414acb",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.7-tuxcare.4 of @angular/core."
      }
    },
    {
      "id": "CVE-2026-88057",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@16.2.7-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:04d8865a-1e5b-5da1-b781-087cb37784f9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88057 affects version 16.2.7-tuxcare.4 of @angular/core, and is fixed in 16.2.7-tuxcare.5."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/core@16.2.7-tuxcare.4"
    }
  ]
}