{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8acfabee-7e28-5553-8d38-a50b5ded330c",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8",
      "type": "library",
      "group": "org.apache.tomcat",
      "name": "tomcat-jdbc",
      "version": "9.0.90-tuxcare.8",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:70e20972-0607-59a6-94a7-b79c35541e76",
      "id": "CVE-2020-11996",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-11996 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:63b38930-607c-5394-85ae-b46e7f0682ee",
      "id": "CVE-2020-13934",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-13934 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:08cb096a-ad01-50a7-8be3-6e7601bb7b67",
      "id": "CVE-2020-13943",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13943 does not affect version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc. Fix for CVE-202-13943 for this version has been already backported by the original developers, so brunch 9.0.90 is not vulnerable"
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a5c4dbcf-d3f0-51b7-8511-93a0915b27ea",
      "id": "CVE-2020-9484",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-9484 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d195a8f2-0a7e-5950-8042-9c01f680f006",
      "id": "CVE-2021-24122",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-24122 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d33b9805-62b2-5a33-9fce-2f6e40a71485",
      "id": "CVE-2021-42340",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-42340 does not affect version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc. Patches already applied: 31d62426645824bdfe076a0c0eafa904d90b4fb9 (already in target via 80f1438ec4 'Close WebConnection', a37a6d312c 'Fix BZ 68884 - improve handling of large scale WebSocket disconnects')"
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b13d1b11-5485-5360-ab10-90e4fbfada40",
      "id": "CVE-2022-34305",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-34305 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b4e91b5d-ee5e-54d5-b581-e6dea1bc2b09",
      "id": "CVE-2022-45143",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-45143 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9df38685-a228-595f-bda5-ceffb3c770cf",
      "id": "CVE-2024-23672",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-23672 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:db387f0d-6d72-50e1-a4b3-87155a1faf15",
      "id": "CVE-2024-24549",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-24549 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:493f2785-c199-5cd5-bd3c-86d9cda4da95",
      "id": "CVE-2024-50379",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-50379 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:41042509-8fc2-56ca-80f4-05ff74c78725",
      "id": "CVE-2024-52316",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-52316 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fa9524f2-b1f8-581d-81ae-3914ee969fe3",
      "id": "CVE-2024-54677",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-54677 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:941a0292-2297-5c1c-967d-3901c8b9f1f4",
      "id": "CVE-2024-56337",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-56337 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:18b5a1db-8ace-5d9f-9bcb-bb60bc4c45a3",
      "id": "CVE-2025-24813",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-24813 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:afe2078b-d99a-54e1-85d6-f1e415761f35",
      "id": "CVE-2025-31650",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-31650 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:066da9d5-4b32-5c4a-87ca-4118e6934ad7",
      "id": "CVE-2025-31651",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-31651 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4a3ec0c6-aaab-5e83-bee3-64554df765b4",
      "id": "CVE-2025-46701",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-46701 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b7fbc01a-f22c-551a-ad1d-603d5f8943c4",
      "id": "CVE-2025-48988",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-48988 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:36d1ae71-f051-5458-8ccb-1dacb64d12a1",
      "id": "CVE-2025-48989",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-48989 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:776df838-1191-55a3-a826-93f65aaf5d56",
      "id": "CVE-2025-49124",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-49124 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:30b51284-3c70-507e-9788-d407935ba71d",
      "id": "CVE-2025-49125",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-49125 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ca3eb9d6-a627-53e3-83c6-3247bc9bab86",
      "id": "CVE-2025-52434",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-52434 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bc63d1e5-a9c2-532b-9f43-9b49174e63ca",
      "id": "CVE-2025-52520",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-52520 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3c5110f4-d4cb-5afb-982d-8ac8eb9007bb",
      "id": "CVE-2025-53506",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-53506 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f4529ad0-3a7b-59d3-b830-64eabb2b7bf2",
      "id": "CVE-2025-55668",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55668 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2281dae9-e85f-5067-90bf-c943b6cc6f4a",
      "id": "CVE-2025-55752",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-55752 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:593d5ca4-e6bc-50df-aca3-a52c733bbe99",
      "id": "CVE-2025-55754",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55754 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f2cad845-645e-5dba-a31d-a282a2aecedb",
      "id": "CVE-2025-61795",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-61795 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c1016389-26ea-508b-8a19-47f9558cf200",
      "id": "CVE-2025-66614",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66614 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5cbd4a1d-1a2c-5241-9552-c48e96380a7a",
      "id": "CVE-2026-24733",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-24733 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:425fb4d5-9bad-5427-bdaa-75851aab20ab",
      "id": "CVE-2026-24734",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-24734 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:16579fd9-50de-5657-8f11-5b4919fa7850",
      "id": "CVE-2026-24880",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-24880 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2fd858ed-355b-5fc9-b9fb-b1ddd5a3bf2e",
      "id": "CVE-2026-25854",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-25854 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1f42790b-d48a-5e8c-b333-bd4dc477a6e0",
      "id": "CVE-2026-29145",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-29145 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2d406b8f-82a9-5633-9e32-2dba1c5b49bf",
      "id": "CVE-2026-29146",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-29146 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3ac6990e-c6fb-5587-ae51-d72d41db3cd1",
      "id": "CVE-2026-32990",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-32990 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:531539a3-39f1-5553-bbc7-9ebaffc04312",
      "id": "CVE-2026-34483",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-34483 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1988e50c-7e9c-5b0a-8058-cb2e39144635",
      "id": "CVE-2026-34486",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-34486 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e3aa8392-fa4a-52f9-9154-d603dc87e94b",
      "id": "CVE-2026-34487",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-34487 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:16e468b8-9680-5fb5-8b5d-d91582873a5f",
      "id": "CVE-2026-41284",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41284 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:02279f85-645f-5e2b-9f81-b35da0501ada",
      "id": "CVE-2026-41293",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41293 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7e1ce9db-921f-5a2a-a270-85a0269b70d8",
      "id": "CVE-2026-42498",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42498 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:044dec79-1249-5473-a19e-230ea85711c1",
      "id": "CVE-2026-43512",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43512 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4941ab7d-bcdd-5e3b-993c-74589ea085fa",
      "id": "CVE-2026-43513",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43513 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:12dfd82c-1d21-5940-a908-516299710779",
      "id": "CVE-2026-43514",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43514 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:44f11a72-996c-521f-9f78-9e88b9541e9c",
      "id": "CVE-2026-43515",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43515 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat-jdbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@9.0.90-tuxcare.8"
    }
  ]
}