{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:eaf550a0-e56b-50d5-99f1-5edae3a6b8a1",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/benchpress",
      "purl": "pkg:npm/%40angular/benchpress@8.0.0-tuxcare.6",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/benchpress@8.0.0-tuxcare.6",
      "version": "8.0.0-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/benchpress",
            "purl": "pkg:npm/%40angular/benchpress@8.0.0",
            "type": "library",
            "version": "8.0.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-101895",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@8.0.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:8994e08d-f9c8-509d-8381-d5eb376d3cc6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-101895 is fixed in version 8.0.0-tuxcare.6 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-101896",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@8.0.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:e3546970-405c-5974-8ee1-c594ac07c7cc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101896 affects version 8.0.0-tuxcare.6 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-41423",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@8.0.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:4e1d4f11-3bb5-5348-b8c8-5a256b727b93",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41423 does not affect version 8.0.0-tuxcare.6 of @angular/benchpress. not_affected \u2014 The target Angular 8.0.0 is not affected by CVE-2026-41423. The vulnerability exists only in newer Angular versions (17+) that use the WHATWG URL API. The target uses Node.js url.parse() which does not interpret protocol-relative URLs (//evil.com) as hostname overrides when used without a base URL parameter.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-46417",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@8.0.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:e41e21cd-1871-5783-8cf3-a27ebbcc2910",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-46417 is fixed in version 8.0.0-tuxcare.6 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-50168",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@8.0.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:4b4ec45c-babc-5f9a-a749-8a87333d573c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50168 is fixed in version 8.0.0-tuxcare.6 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-50169",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@8.0.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:fe2bf7e0-5f75-52e3-9f7d-d79d7ce8c75a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50169 is fixed in version 8.0.0-tuxcare.6 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-50184",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@8.0.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:eb7518b4-1e22-599e-98c4-f729a29895d4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50184 is fixed in version 8.0.0-tuxcare.6 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-50555",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@8.0.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:27fd66ae-d463-52fd-91d7-e7e3a90f5c21",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50555 is fixed in version 8.0.0-tuxcare.6 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-50556",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@8.0.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:9e6d8223-a5ed-5872-ad53-74517bbb48a6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50556 is fixed in version 8.0.0-tuxcare.6 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-54264",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@8.0.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:987d7732-33ee-5c85-8814-8b064adf781b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54264 does not affect version 8.0.0-tuxcare.6 of @angular/benchpress. not_affected \u2014 Target version 8.0.0-tuxcare.2 is NOT AFFECTED by CVE-2026-54264. The Service Worker implementation strips ALL request headers (including Authorization, Proxy-Authorization, and Cookie) when reconstructing network requests for asset fetches. This architectural design prevents sensitive headers from being forwarded to any destination, including cross-origin redirect targets.",
        "justification": "protected_at_runtime"
      }
    },
    {
      "id": "CVE-2026-69149",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@8.0.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:cbbeb74f-d203-57f6-be9d-bde04e16fe1a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-69149 is fixed in version 8.0.0-tuxcare.6 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-88056",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@8.0.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:f829fbc0-0ab7-5f7f-8b61-b8bc87601552",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88056 does not affect version 8.0.0-tuxcare.6 of @angular/benchpress. not_affected \u2014 Angular 8.0.0 is NOT AFFECTED by CVE-2026-88056. The vulnerable code patterns described in the CVE do not exist in this version. The CVE affects newer Angular versions (v18-22+) that include server-side URL transformation features (relativeUrlsTransformerInterceptorFn interceptor and url.ts with trim() call) which were introduced years after Angular 8.0.0's 2019 release. The chain from maliciou...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-88058",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@8.0.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:c2a413fd-d1db-5c1f-b065-046229802379",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-88058 is fixed in version 8.0.0-tuxcare.6 of @angular/benchpress."
      }
    },
    {
      "id": "CVE-2026-88060",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/benchpress@8.0.0-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:b0f6271b-3313-5753-b2d8-d70ab16798a4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-88060 is fixed in version 8.0.0-tuxcare.6 of @angular/benchpress."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/benchpress@8.0.0-tuxcare.6"
    }
  ]
}