{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:75d42db3-1c90-5141-9fd8-e695ecbde9d9",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/%40angular/http@7.2.11-tuxcare.3",
      "type": "library",
      "name": "@angular/http",
      "version": "7.2.11-tuxcare.3",
      "purl": "pkg:npm/%40angular/http@7.2.11-tuxcare.3"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:87de8503-47bc-571b-b350-8e7ceef1e68a",
      "id": "CVE-2021-4231",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-4231 is fixed in version 7.2.11-tuxcare.3 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@7.2.11-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4bfd27f2-abac-54a5-a3bc-83fe2dc9ed6d",
      "id": "CVE-2025-66035",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66035 is fixed in version 7.2.11-tuxcare.3 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@7.2.11-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4404dcad-7ab6-52b1-bdcb-80d7faef7da2",
      "id": "CVE-2025-66412",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66412 is fixed in version 7.2.11-tuxcare.3 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@7.2.11-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2ec3107e-f26e-5b03-8115-1dc7f3e5a57b",
      "id": "CVE-2026-22610",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22610 is fixed in version 7.2.11-tuxcare.3 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@7.2.11-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:40acebc4-12d7-5cf0-8bb7-61de43281e13",
      "id": "CVE-2026-27970",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-27970 is fixed in version 7.2.11-tuxcare.3 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@7.2.11-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e7540808-ab19-5d17-a40f-ddb438d763ff",
      "id": "CVE-2026-41423",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41423 is fixed in version 7.2.11-tuxcare.3 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@7.2.11-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:464ff293-b3ae-5059-8826-f793f29ac27c",
      "id": "CVE-2026-46417",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-46417 is fixed in version 7.2.11-tuxcare.3 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@7.2.11-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d628bc26-31d6-5970-962f-ca7251ca27f3",
      "id": "CVE-2026-50168",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-50168 does not affect version 7.2.11-tuxcare.3 of @angular/http. not_affected \u2014 CVE-2026-50168 addresses vulnerabilities in the WHATWG URL-based parseUrl implementation and allowedHosts validation feature introduced in Angular's CVE-2026-41423 fix. The target (v7.2.11) uses a completely different architecture with Node.js legacy url.parse() and does not have the allowedHosts feature. The specific vulnerable code patterns that CVE-2026-50168 patches do not exist in this ver..."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@7.2.11-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7ace0edb-7526-5328-803f-b30f040be6a5",
      "id": "CVE-2026-50169",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50169 is fixed in version 7.2.11-tuxcare.3 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@7.2.11-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e850bf7f-2673-5f20-abda-148c87878c9e",
      "id": "CVE-2026-50170",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-50170 does not affect version 7.2.11-tuxcare.3 of @angular/http. not_affected \u2014 Angular v7.2.11 is not affected by CVE-2026-50170. The HTTP Transfer Cache feature that is vulnerable does not exist in this version. The feature was introduced in Angular v16+, and v7.2.11 lacks the transfer_cache.ts module, withHttpTransferCache provider, and provideClientHydration functionality entirely."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@7.2.11-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:27f9ad16-7fff-5636-867d-7374e1b217d8",
      "id": "CVE-2026-50171",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50171 is fixed in version 7.2.11-tuxcare.3 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@7.2.11-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2be177b8-1d0a-58c8-85d5-83805f65b380",
      "id": "CVE-2026-50184",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50184 is fixed in version 7.2.11-tuxcare.3 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@7.2.11-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9b767dfa-7e73-5091-b2d8-5223317bdf04",
      "id": "CVE-2026-50555",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50555 is fixed in version 7.2.11-tuxcare.3 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@7.2.11-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6f4d645d-7e5e-5113-8818-7cd5f3ed066d",
      "id": "CVE-2026-50556",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50556 is fixed in version 7.2.11-tuxcare.3 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@7.2.11-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c5f807eb-eb53-5722-8079-4e14d2f7bd36",
      "id": "CVE-2026-50557",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50557 is fixed in version 7.2.11-tuxcare.3 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@7.2.11-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f940188a-139d-51dd-a7db-bd0f76cdf346",
      "id": "CVE-2026-52725",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-52725 is fixed in version 7.2.11-tuxcare.3 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@7.2.11-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cd96b0d8-f2b7-5f88-ab1c-da60ad5f8aa0",
      "id": "CVE-2026-54264",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54264 does not affect version 7.2.11-tuxcare.3 of @angular/http. not_affected \u2014 Angular 7.2.11-tuxcare.2 is not affected by CVE-2026-54264. The vulnerability concerns sensitive header leakage on cross-origin redirects in the request metadata preservation feature. This version predates that feature entirely - it strips ALL request headers when making network requests for assets, as evidenced by code comments and the absence of the newRequestWithMetadata method introduced in..."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@7.2.11-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c8548127-ed56-5d02-b18b-cc274327c873",
      "id": "CVE-2026-54265",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54265 does not affect version 7.2.11-tuxcare.3 of @angular/http. not_affected \u2014 Angular 7.2.11-tuxcare.2 uses View Engine compiler architecture, not Ivy. The vulnerability (CVE-2026-54265) is specific to Ivy's template compiler pipeline where TwoWayProperty operations were missing from the sanitizer resolution switch. View Engine does not have TwoWayProperty operations; two-way bindings desugar early in the template parser to the same parsePropertyBinding() code path as on..."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@7.2.11-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3cb5103b-3651-574d-a535-b0c72f9fb8f2",
      "id": "CVE-2026-54266",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54266 does not affect version 7.2.11-tuxcare.3 of @angular/http. not_affected \u2014 Angular 7.2.11-tuxcare.2 is not affected by CVE-2026-54266. The HttpTransferCache feature that contains the weak hash vulnerability does not exist in this version - it was introduced in Angular 16."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@7.2.11-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c3fb25ff-fc09-5722-95a9-f54ae81215c4",
      "id": "CVE-2026-54267",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54267 is fixed in version 7.2.11-tuxcare.3 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@7.2.11-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:db1edc2a-e8b6-5e94-824c-986a3e3e434b",
      "id": "CVE-2026-54268",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54268 is fixed in version 7.2.11-tuxcare.3 of @angular/http."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/http@7.2.11-tuxcare.3"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/http@7.2.11-tuxcare.3"
    }
  ]
}