{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0932b608-410d-5c91-a3fd-4356e80ab0a1",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/benchpress",
      "purl": "pkg:npm/%40angular/benchpress@5.1.0-tuxcare.8",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/benchpress@5.1.0-tuxcare.8",
      "version": "5.1.0-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/benchpress",
            "purl": "pkg:npm/%40angular/benchpress@5.1.0",
            "type": "library",
            "version": "5.1.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-101895",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@5.1.0-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:71d8c037-fea2-5cec-b8da-3aec7b8e6eab",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-101895 is fixed in version 5.1.0-tuxcare.8 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-101896",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@5.1.0-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:1ed1be2c-81c6-519a-8426-4723a16aaf69",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101896 affects version 5.1.0-tuxcare.8 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-41423",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@5.1.0-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:8335af96-262b-5bbd-9ae4-e99c06b8ee12",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41423 does not affect version 5.1.0-tuxcare.8 of @angular/benchpress. not_affected \u2014 The target repository (Angular 5.1.0) uses Node.js url.parse() API which does not extract hostname from protocol-relative URLs (//evil.com/path), unlike the WHATWG URL API used in vulnerable upstream versions. Additionally, Angular 5.1.0's PlatformLocation architecture does not expose hostname/protocol/port fields, only pathname/search/hash. The vulnerability mechanism (WHATWG URL's protocol-re...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-46417",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@5.1.0-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:f074343b-76f4-5c76-93b1-24a12e634e8f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.1.0-tuxcare.8 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-50168",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@5.1.0-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:65687419-ad31-5251-b7ec-34c87d82ddd7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.1.0-tuxcare.8 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-50169",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@5.1.0-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:17a3bb52-3572-5d9c-b11c-d634025ea112",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.1.0-tuxcare.8 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-50184",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@5.1.0-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:8780546e-2045-50d8-80bd-866782324898",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.1.0-tuxcare.8 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-50555",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@5.1.0-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:abbeac75-a5c7-50a4-8990-4d60da1ce1dd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.1.0-tuxcare.8 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-50556",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@5.1.0-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:0a73d5cc-0b8d-516a-a0ec-217a96e44324",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.1.0-tuxcare.8 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-54264",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@5.1.0-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:c0d29d9f-7a03-55d0-a0bf-241cfe6d1163",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54264 does not affect version 5.1.0-tuxcare.8 of @angular/benchpress. not_affected \u2014 Angular 5.1.0-tuxcare.1 is not affected by CVE-2026-54264. The service worker in this version does not preserve or forward request headers when reconstructing asset requests, eliminating the vulnerability pattern entirely. Asset requests are rebuilt from URLs only, with no header copying logic.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-69149",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@5.1.0-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:d2b520f9-784a-50f5-b126-f92ee7340bd5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.1.0-tuxcare.8 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-88056",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@5.1.0-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:9110cca0-93f6-59c5-a570-2f844081c427",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88056 does not affect version 5.1.0-tuxcare.8 of @angular/benchpress. not_affected \u2014 Angular 5.1.0 is not affected by CVE-2026-88056. The vulnerable code pattern (the parseUrl function with String.prototype.trim() in packages/platform-server/src/url.ts) does not exist in this version. The CVE affects modern Angular versions (13+) with the newer SSR architecture featuring relative URL transformation interceptors, which were introduced after Angular 5.1.0.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88058",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@5.1.0-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:dc5fcbeb-c111-59be-8a65-80138c108c76",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-88058 is fixed in version 5.1.0-tuxcare.8 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-88060",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@5.1.0-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:3e84268b-8988-55fa-9d5e-cecfb8958b9c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-88060 is fixed in version 5.1.0-tuxcare.8 of @angular/benchpress."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/benchpress@5.1.0-tuxcare.8"
    }
  ]
}