{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:bc9e2387-37c3-5a6e-acfd-05dd8854ddf8",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/language-service",
      "purl": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.14",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.14",
      "version": "9.1.13-tuxcare.14",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/language-service",
            "purl": "pkg:npm/%40angular/language-service@9.1.13",
            "type": "library",
            "version": "9.1.13"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-101895",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:ab83fc34-492a-560d-8046-5d2181375e81",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101895 affects version 9.1.13-tuxcare.14 of @angular/language-service, and is fixed in 9.1.13-tuxcare.16."
      }
    },
    {
      "id": "CVE-2026-101896",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:4fd5ae1b-a9fa-5790-b0b2-4d47615d08c7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101896 affects version 9.1.13-tuxcare.14 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-41423",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:04d5a2ce-6544-5eb2-bbda-86c68b719096",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41423 is fixed in version 9.1.13-tuxcare.14 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-46417",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:0fa8320b-d5b1-5f69-a593-5b2ab3090913",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-46417 is fixed in version 9.1.13-tuxcare.14 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-50168",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:1e1f8ef8-327d-5d7a-9de5-867d0bab3284",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50168 is fixed in version 9.1.13-tuxcare.14 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-50169",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:fa265daf-270e-54e1-8755-bbadf09a358b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50169 is fixed in version 9.1.13-tuxcare.14 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-50184",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:d60300f1-acb6-50a6-a907-a38483e0787f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50184 is fixed in version 9.1.13-tuxcare.14 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-50555",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:959a1258-fb7f-5975-9216-5e9edc29a2d5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50555 is fixed in version 9.1.13-tuxcare.14 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-50556",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:fae8f10b-0668-572d-bc2d-34cf6bdd7db5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50556 is fixed in version 9.1.13-tuxcare.14 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-54264",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:77a7d4ba-2459-5e03-a9c9-989277471c56",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54264 does not affect version 9.1.13-tuxcare.14 of @angular/language-service. not_affected \u2014 Angular 9.1.13 is not affected by CVE-2026-54264. The target repository uses a fundamentally different request reconstruction architecture than the vulnerable upstream versions (22.0+). The vulnerability requires the presence of header-copying logic during request reconstruction, which does not exist in this version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-69149",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:af16812d-3b12-5cea-9c47-aeec8e4b69ac",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-69149 is fixed in version 9.1.13-tuxcare.14 of @angular/language-service."
      }
    },
    {
      "id": "CVE-2026-88056",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:7a5da537-63d2-5ffe-b082-c4041f5ba54b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88056 does not affect version 9.1.13-tuxcare.14 of @angular/language-service. not_affected \u2014 Angular 9.1.13 is not affected by CVE-2026-88056. The vulnerability requires String.prototype.trim() to be called on URLs during server-side rendering, which strips Unicode whitespace and transforms same-origin relative paths into cross-origin protocol-relative URLs. This vulnerable pattern was introduced in Angular v22.0.0-rc.2 (May 2026, commit 6e71049021) as part of a URL resolution refactor...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-88058",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:b4b97e22-5e57-57f2-98ce-2f323f49deff",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88058 affects version 9.1.13-tuxcare.14 of @angular/language-service, and is fixed in 9.1.13-tuxcare.15."
      }
    },
    {
      "id": "CVE-2026-88060",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:ac87665b-49ed-511a-8208-448655534af5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88060 affects version 9.1.13-tuxcare.14 of @angular/language-service, and is fixed in 9.1.13-tuxcare.15."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/language-service@9.1.13-tuxcare.14"
    }
  ]
}