{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f27c5cba-b42b-54b1-8405-525aa0c96aca", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/nuxt@3.12.4-tuxcare.6", "type": "library", "name": "nuxt", "version": "3.12.4-tuxcare.6", "purl": "pkg:npm/nuxt@3.12.4-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:74246e05-dd5b-5414-85e7-f97db5fa530b", "id": "CVE-2022-25852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25852 affects version 3.12.4-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:68428ef5-dec8-5608-991b-549c816f08f0", "id": "CVE-2025-24360", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24360 is fixed in version 3.12.4-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:bda05935-fadf-562b-b5dd-4c6d8c991619", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.4-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:db7b991f-1b74-505f-8c07-4cf2e81a8b9e", "id": "CVE-2025-27415", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27415 affects version 3.12.4-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c9fa198b-f98e-5579-b245-888b73fcdb70", "id": "CVE-2025-58751", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-58751 affects version 3.12.4-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:cb3c1233-657a-5e95-988d-f8c921ed7514", "id": "CVE-2025-59414", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59414 affects version 3.12.4-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:67410bed-a044-5f1c-9bc5-4821cb2463d4", "id": "CVE-2025-62522", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-62522 is fixed in version 3.12.4-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0b1dc129-4197-5187-b342-28a446f11b89", "id": "CVE-2026-41305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41305 affects version 3.12.4-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d5cae87a-d13d-5301-bde3-271c7cee07d4", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for nuxt 3.12.4-tuxcare.6. false_positive \u2014 CVE-2026-42338 is a false positive match for this repository. The CVE concerns the 'ip-address' npm package (specifically XSS vulnerabilities in the Address6 class), but this repository is 'nuxt' (Nuxt.js web framework version 3.12.4-tuxcare.5). Exhaustive search confirmed that the ip-address package is not present in this repository as the project itself, as a vendored/bundled copy, or as a de..." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:009d8394-749a-5cc3-850e-9395ce107597", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.4-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1b1c071f-1a90-5f6c-8c99-16a353c2c235", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.4-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:3998ee0c-7278-52a2-81e6-28a0d728e3f4", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.4-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9d32dc44-2f14-52a5-bb85-4c43ac6c82e3", "id": "CVE-2026-53721", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53721 affects version 3.12.4-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:245e5b87-a61b-5a01-97bb-e61edb56e580", "id": "CVE-2026-53722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53722 affects version 3.12.4-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f1a2a245-557b-57d5-b92f-8a2d56a4d8d5", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.4-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d2956353-e577-526b-93fa-94c9a1d6f694", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 affects version 3.12.4-tuxcare.6 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b822ade1-8448-5059-9eb5-1da5433a8d3e", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.4-tuxcare.6 of nuxt. not_affected \u2014 Target version (nuxt@3.12.4-tuxcare.5) is NOT affected by GHSA-m3q2-p4fw-w38m. The vulnerability was introduced 1754 commits AFTER v3.12.4 when Nuxt upgraded from unhead v1 to v2 in v3.16.0. The target uses a fundamentally different, older implementation that does not contain the vulnerable innerHTML pattern." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.6" } ] }