{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:56d8a2f0-90ad-52f1-a8aa-5cb436eae866",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/core",
      "purl": "pkg:npm/%40angular/core@4.3.5-tuxcare.10",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/core@4.3.5-tuxcare.10",
      "version": "4.3.5-tuxcare.10",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/core",
            "purl": "pkg:npm/%40angular/core@4.3.5",
            "type": "library",
            "version": "4.3.5"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-4231",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@4.3.5-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:9e4b7f81-43e1-5300-aaf0-20addcae8a30",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-4231 is fixed in version 4.3.5-tuxcare.10 of @angular/core."
      }
    },
    {
      "id": "CVE-2026-22610",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@4.3.5-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:cb5e05fb-acea-583a-9ab0-e87c52fbe160",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22610 is fixed in version 4.3.5-tuxcare.10 of @angular/core."
      }
    },
    {
      "id": "CVE-2026-27970",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@4.3.5-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:370d72ec-9e51-5a49-ae6c-04415515b873",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-27970 is fixed in version 4.3.5-tuxcare.10 of @angular/core."
      }
    },
    {
      "id": "CVE-2026-32635",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@4.3.5-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:a80f6470-157e-5e26-b8d5-76ddfa81c4b7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-32635 affects version 4.3.5-tuxcare.10 of @angular/core."
      }
    },
    {
      "id": "CVE-2026-50557",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@4.3.5-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:681844e2-546e-55d1-beda-936bc8ac8be8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50557 is fixed in version 4.3.5-tuxcare.10 of @angular/core."
      }
    },
    {
      "id": "CVE-2026-52725",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@4.3.5-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:79c2bf8e-aa5f-5566-8e42-b49687c1448f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-52725 does not affect version 4.3.5-tuxcare.10 of @angular/core. not_affected \u2014 Angular v4.3.5 is not affected by CVE-2026-52725. This version uses View Engine exclusively and lacks both the vulnerable Ivy render3/locateHostElement code path and the public createComponent({hostElement}) API (introduced in v14+) that enables exploitation. The vulnerability is specific to Ivy's component mounting implementation.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-54267",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@4.3.5-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:431b495f-3495-58b5-8e70-28019521a923",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54267 does not affect version 4.3.5-tuxcare.10 of @angular/core. not_affected \u2014 Angular v4.3.5 is not affected by CVE-2026-54267. The SSR Hydration TransferState feature that contains the DOM clobbering vulnerability was introduced in Angular v16. Version 4.3.5 does not contain the vulnerable code pattern (getElementById followed by JSON.parse of textContent for hydration state), the TransferState APIs, or any client-side hydration mechanism.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-69151",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@4.3.5-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:35735c27-ebbb-5bdd-8349-5293f40e20de",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-69151 is fixed in version 4.3.5-tuxcare.10 of @angular/core."
      }
    },
    {
      "id": "CVE-2026-88057",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@4.3.5-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:6f44c325-08b2-5211-8378-5baf020ea93f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-88057 is fixed in version 4.3.5-tuxcare.10 of @angular/core."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/core@4.3.5-tuxcare.10"
    }
  ]
}