{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:af334603-da8e-59b6-874e-6a4159b492f9",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/%40angular/core@5.1.2-tuxcare.3",
      "type": "library",
      "name": "@angular/core",
      "version": "5.1.2-tuxcare.3",
      "purl": "pkg:npm/%40angular/core@5.1.2-tuxcare.3"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:21ba6f4d-6b4b-5927-94da-0eb0b82bc301",
      "id": "CVE-2021-4231",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.1.2-tuxcare.3 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@5.1.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:936578d7-6834-545e-a45c-ee6851d3b7d1",
      "id": "CVE-2025-66035",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.1.2-tuxcare.3 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@5.1.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bf848ef0-0497-5f9d-8de7-b192c558e1ec",
      "id": "CVE-2025-66412",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.1.2-tuxcare.3 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@5.1.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7b675bd9-fb68-5f44-a991-77dec9fbc243",
      "id": "CVE-2026-22610",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.1.2-tuxcare.3 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@5.1.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d5f0112f-162d-504e-bfa2-cab60e1ff2cd",
      "id": "CVE-2026-27970",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.1.2-tuxcare.3 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@5.1.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:deb6971b-9ecf-5339-b6bd-c8c80b9e2d03",
      "id": "CVE-2026-41423",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41423 does not affect version 5.1.2-tuxcare.3 of @angular/core. not_affected \u2014 Angular version 5.1.2 is not affected by CVE-2026-41423. The vulnerability requires the WHATWG URL API which exhibits hostname override behavior with protocol-relative URLs. The target uses Node.js's legacy url.parse() API which does not have this behavior."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@5.1.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f1275adb-0c0c-5080-a485-bceed0ad84cd",
      "id": "CVE-2026-46417",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.1.2-tuxcare.3 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@5.1.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:824fc37f-d0b6-5623-85be-0ce7cb2cf659",
      "id": "CVE-2026-50168",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.1.2-tuxcare.3 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@5.1.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:65363b47-7f76-56f3-9c79-423b10c034ec",
      "id": "CVE-2026-50169",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.1.2-tuxcare.3 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@5.1.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:28f0b9da-b5b1-5df5-8369-8f7ca0f36ddb",
      "id": "CVE-2026-50170",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-50170 does not affect version 5.1.2-tuxcare.3 of @angular/core. not_affected \u2014 no evidence captured"
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@5.1.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:01624236-5c43-5246-ac8f-97b189321cbd",
      "id": "CVE-2026-50171",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.1.2-tuxcare.3 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@5.1.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1a7a47e5-8c30-5425-9996-07fcfe1885d1",
      "id": "CVE-2026-50184",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.1.2-tuxcare.3 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@5.1.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3bbe48be-4d7c-5481-815d-b1c12c5b4de5",
      "id": "CVE-2026-50555",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.1.2-tuxcare.3 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@5.1.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cfe4aa1a-9271-59bb-9d19-5ea4d611df8f",
      "id": "CVE-2026-50556",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.1.2-tuxcare.3 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@5.1.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:26cae72c-242f-56f0-816b-8ba55037a88e",
      "id": "CVE-2026-50557",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.1.2-tuxcare.3 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@5.1.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ddfbfcf2-9894-5d90-a611-81a8d3e69c32",
      "id": "CVE-2026-52725",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.1.2-tuxcare.3 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@5.1.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fcafa03e-4c57-575a-a1e9-a2b45ac914fc",
      "id": "CVE-2026-54264",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54264 does not affect version 5.1.2-tuxcare.3 of @angular/core. not_affected \u2014 Angular v5.1.2-tuxcare.1 is NOT affected by CVE-2026-54264. The vulnerability requires a `newRequestWithMetadata` function that copies request headers, which does not exist in this version. The service worker reconstructs asset requests from URLs only using bare `adapter.newRequest(url)` calls, never copying or forwarding request headers. Therefore, credential headers cannot be leaked on cross-..."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@5.1.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:76cfc652-f2ca-5a04-b741-b31ba50a2a4f",
      "id": "CVE-2026-54265",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54265 does not affect version 5.1.2-tuxcare.3 of @angular/core. not_affected \u2014 Angular 5.1.2 uses the View Engine compiler architecture, which does not have the TwoWayProperty operation kind that is vulnerable in the Ivy compiler. In View Engine, two-way bindings desugar through the same parsePropertyBinding() code path as one-way bindings, ensuring both receive identical security context resolution and sanitization. The vulnerability pattern described in CVE-2026-54265 c..."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@5.1.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a0fbcd5e-76d1-5b8b-ab2f-2c0a113ec454",
      "id": "CVE-2026-54266",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54266 does not affect version 5.1.2-tuxcare.3 of @angular/core. not_affected \u2014 Angular 5.1.2 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature that generates cache keys using a weak 32-bit DJB2 hash does not exist in this version. This feature was introduced in Angular v16+, while the target is v5.1.2. Although TransferState exists in this version for basic state transfer, there is no integration with HttpClient for automatic response caching, no..."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@5.1.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9076e05e-a377-5260-82da-0a974c12458c",
      "id": "CVE-2026-54267",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.1.2-tuxcare.3 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@5.1.2-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5300d6bf-7822-5044-bfe4-74977cc63cfd",
      "id": "CVE-2026-54268",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.1.2-tuxcare.3 of @angular/core."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/core@5.1.2-tuxcare.3"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/core@5.1.2-tuxcare.3"
    }
  ]
}