{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a51923c9-1abf-53c5-91a3-c23a8a17604b",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/benchpress",
      "purl": "pkg:npm/%40angular/benchpress@4.4.7-tuxcare.13",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/benchpress@4.4.7-tuxcare.13",
      "version": "4.4.7-tuxcare.13",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/benchpress",
            "purl": "pkg:npm/%40angular/benchpress@4.4.7",
            "type": "library",
            "version": "4.4.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-101895",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:99e9975d-3199-518f-a7fd-3e646044aa1d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-101895 does not affect version 4.4.7-tuxcare.13 of @angular/benchpress. not_affected \u2014 Angular v4.4.7 is NOT affected by CVE-2026-101895. The vulnerability is specific to the `domino` DOM emulation library's HTMLParser.js tokenizer state machine. Angular v4.4.7 uses `parse5` (v3.0.2) for server-side rendering HTML parsing, NOT domino. Domino was only adopted by @angular/platform-server in Angular v5+. The vulnerable code path (domino's lib/HTMLParser.js after_doctype_name_state h...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-101896",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:b7bb9fa0-a2d6-5131-9bbc-d7f51fe41a50",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101896 affects version 4.4.7-tuxcare.13 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-41423",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:b156df28-e405-5e12-8d20-bfc111ff862c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41423 is fixed in version 4.4.7-tuxcare.13 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-46417",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:6c08d2f0-c86b-551b-bb0d-e83d787edbdf",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-46417 is fixed in version 4.4.7-tuxcare.13 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-50168",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:b45dfe79-0701-5f11-bc40-34b371281285",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50168 is fixed in version 4.4.7-tuxcare.13 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-50169",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:51b11ea9-69c3-52f5-9206-bfd1ea2f1b1e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50169 is fixed in version 4.4.7-tuxcare.13 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-50184",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:31b39222-f12c-5111-85a0-3ca276abd97a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50184 is fixed in version 4.4.7-tuxcare.13 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-50555",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:faea84c6-52e7-5c02-bc3d-080b12498c6b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50555 is fixed in version 4.4.7-tuxcare.13 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-50556",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:8040b7d7-2b1c-54da-b0c6-2776b0639685",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50556 is fixed in version 4.4.7-tuxcare.13 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-54264",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:ea0fbab3-3b94-5f5c-b54c-3585aebff1c0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54264 is fixed in version 4.4.7-tuxcare.13 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-69149",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:7ec46811-a390-5d45-9c52-0541bb848484",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-69149 does not affect version 4.4.7-tuxcare.13 of @angular/benchpress. Angular 4.4.7 does not use domino for DOM emulation. The CVE specifically affects domino's serializer (lib/NodeUtils.js), which fails to escape text nodes in fallback raw-content elements (iframe, noembed, noframes, noscript). Angular 4.4.7 uses parse5 version 3.0.2 for HTML parsing and serialization instead. Domino was introduced to Angular approximately 6 years later in February 2023 (Angular 15+, commit 76731ae5c8). The vulnerable component (domino) is not present in this version, making it not affected by CVE-2026-69149.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88056",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:71735f06-5450-5d9c-9ac0-5c0609ef733b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88056 does not affect version 4.4.7-tuxcare.13 of @angular/benchpress. not_affected \u2014 Angular 4.4.7-tuxcare.10 is not affected by CVE-2026-88056. The vulnerability requires a `urlStr.trim()` call in URL resolution that strips Unicode whitespace (U+00A0, U+FEFF), converting validated same-origin relative paths into cross-origin protocol-relative URLs. This vulnerable code pattern does not exist in Angular 4.4.7. The target version uses a simple `parseUrl()` function in `location....",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88058",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:f5a2fab2-5fe0-5750-9796-e2e48bd1bd36",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-88058 is fixed in version 4.4.7-tuxcare.13 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-88060",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@4.4.7-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:65ea23dd-fcb1-5862-a9a8-c1bf176561bd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-88060 is fixed in version 4.4.7-tuxcare.13 of @angular/benchpress."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/benchpress@4.4.7-tuxcare.13"
    }
  ]
}