{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:9ff84b5c-3aad-5bbd-af93-fac56d59c848",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/language-service",
      "purl": "pkg:npm/%40angular/language-service@10.2.5-tuxcare.13",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/language-service@10.2.5-tuxcare.13",
      "version": "10.2.5-tuxcare.13",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/language-service",
            "purl": "pkg:npm/%40angular/language-service@10.2.5",
            "type": "library",
            "version": "10.2.5"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-101895",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@10.2.5-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:6432b415-40af-5210-b86f-c94d27a40c23",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-101895 is fixed in version 10.2.5-tuxcare.13 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-101896",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@10.2.5-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:94b267d7-906b-54d1-9e08-004fb8c86745",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101896 affects version 10.2.5-tuxcare.13 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-41423",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@10.2.5-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:555b75d7-e30b-524b-bfb5-0ca0e9d317b1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41423 is fixed in version 10.2.5-tuxcare.13 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-46417",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@10.2.5-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:7653f6e9-1e13-5cdb-9b65-6520dbe1624d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-46417 is fixed in version 10.2.5-tuxcare.13 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-50168",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@10.2.5-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:20442647-fe47-5caa-9fab-fd999f8e20ac",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50168 is fixed in version 10.2.5-tuxcare.13 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-50169",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@10.2.5-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:10cd9fd1-9042-57f2-b014-3cea62b63694",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50169 is fixed in version 10.2.5-tuxcare.13 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-50184",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@10.2.5-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:fb1103ad-02a0-5db4-a793-3ba3cec4f810",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50184 is fixed in version 10.2.5-tuxcare.13 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-50555",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@10.2.5-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:068f66c0-e422-5d21-b16c-b93f62624f6c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50555 is fixed in version 10.2.5-tuxcare.13 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-50556",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@10.2.5-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:098dd125-ca9f-54df-bdcf-1e3ca26e9c72",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50556 is fixed in version 10.2.5-tuxcare.13 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-54264",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@10.2.5-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:7708e24b-1a40-5973-9765-cb971a0e1a09",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54264 does not affect version 10.2.5-tuxcare.13 of @angular/language-service. not_affected \u2014 Angular version 10.2.5-tuxcare.7 is NOT affected by CVE-2026-54264. The service worker in this version does not preserve request headers when creating network requests, making it impossible for sensitive headers to leak on cross-origin redirects. The vulnerable code pattern (newRequestWithMetadata with header preservation) does not exist in this version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-69149",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@10.2.5-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:dc448c1a-d327-5ffd-a306-e6c8f5b8b667",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-69149 is fixed in version 10.2.5-tuxcare.13 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-88056",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@10.2.5-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:cfbc70ce-fa4b-58f1-afd5-af57a8036b7a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88056 does not affect version 10.2.5-tuxcare.13 of @angular/language-service. not_affected \u2014 Angular 10.2.5 is not affected by CVE-2026-88056. The vulnerability requires a `String.prototype.trim()` call in URL resolution that strips Unicode whitespace, converting same-origin relative paths into cross-origin protocol-relative URLs. This vulnerable code pattern was never present in Angular 10.2.5 and was introduced only in later versions (Angular 19+). Without the trim() call, URLs with ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88058",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@10.2.5-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:8afc02e6-e144-5b74-8242-8cec46b99213",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-88058 is fixed in version 10.2.5-tuxcare.13 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-88060",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@10.2.5-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:8ecdd852-6365-5bf2-adbc-8b188bf29e4f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-88060 is fixed in version 10.2.5-tuxcare.13 of @angular/language-service."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/language-service@10.2.5-tuxcare.13"
    }
  ]
}