{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:9891f740-8c33-5ee0-9237-cc0753271b62",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/%40angular/localize@13.3.12-tuxcare.1",
      "type": "library",
      "name": "@angular/localize",
      "version": "13.3.12-tuxcare.1",
      "purl": "pkg:npm/%40angular/localize@13.3.12-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:28c3232b-0375-5064-be3e-7a2f74b4761c",
      "id": "CVE-2025-66035",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66035 is fixed in version 13.3.12-tuxcare.1 of @angular/localize."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/localize@13.3.12-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:028907c0-6e84-52bf-967d-ba215519bdb6",
      "id": "CVE-2025-66412",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-66412 affects version 13.3.12-tuxcare.1 of @angular/localize."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/localize@13.3.12-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:913b67d3-1fe6-5839-b4d6-347efb98e159",
      "id": "CVE-2026-22610",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22610 affects version 13.3.12-tuxcare.1 of @angular/localize."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/localize@13.3.12-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3a91d95e-bf97-5918-96e6-295453b03b29",
      "id": "CVE-2026-27970",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-27970 affects version 13.3.12-tuxcare.1 of @angular/localize."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/localize@13.3.12-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f4b1512f-8999-5b65-a36c-a0fd7ed996fd",
      "id": "CVE-2026-41423",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41423 affects version 13.3.12-tuxcare.1 of @angular/localize."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/localize@13.3.12-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ec37d23f-5db9-5a8e-be7a-f9add1f15625",
      "id": "CVE-2026-46417",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-46417 affects version 13.3.12-tuxcare.1 of @angular/localize."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/localize@13.3.12-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4677a868-e8ad-5f6c-abd3-d48d1cd0b7fb",
      "id": "CVE-2026-50168",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50168 affects version 13.3.12-tuxcare.1 of @angular/localize."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/localize@13.3.12-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4956c491-1825-5388-a81e-65a415c1e5ec",
      "id": "CVE-2026-50169",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50169 affects version 13.3.12-tuxcare.1 of @angular/localize."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/localize@13.3.12-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5e98eb26-c7b9-5fe4-85e8-01f22b17b20b",
      "id": "CVE-2026-50170",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-50170 does not affect version 13.3.12-tuxcare.1 of @angular/localize. not_affected \u2014 Angular v13.3.12 is NOT AFFECTED by CVE-2026-50170. The HttpTransferCache feature that contains the vulnerability was introduced in Angular v16.0.0 (March 2023) and does not exist in this earlier version."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/localize@13.3.12-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:64642d1b-2b6f-5eed-ba99-7f59c3cfbe06",
      "id": "CVE-2026-50171",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50171 affects version 13.3.12-tuxcare.1 of @angular/localize."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/localize@13.3.12-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:65d91b8c-c36c-5730-b541-adb67de79e85",
      "id": "CVE-2026-50184",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50184 affects version 13.3.12-tuxcare.1 of @angular/localize."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/localize@13.3.12-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d0814d39-7736-5fdc-b6c6-ae11e795b0cc",
      "id": "CVE-2026-50555",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50555 affects version 13.3.12-tuxcare.1 of @angular/localize."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/localize@13.3.12-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:46766ab8-c8d4-5d98-beb6-e5c2a4776711",
      "id": "CVE-2026-50556",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50556 affects version 13.3.12-tuxcare.1 of @angular/localize."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/localize@13.3.12-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5fda1f32-e372-542a-a66c-45dece3025be",
      "id": "CVE-2026-50557",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50557 affects version 13.3.12-tuxcare.1 of @angular/localize."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/localize@13.3.12-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:278e6b34-2177-56cf-b401-c5acd6ff7347",
      "id": "CVE-2026-52725",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-52725 affects version 13.3.12-tuxcare.1 of @angular/localize."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/localize@13.3.12-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c445a3c5-c720-5e9f-8981-0dca0219ca00",
      "id": "CVE-2026-54264",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54264 does not affect version 13.3.12-tuxcare.1 of @angular/localize. not_affected \u2014 Version 13.3.12 does not have the vulnerable code pattern. The vulnerability exists in versions 20.x+ where the Service Worker's newRequestWithMetadata function preserves request headers but fails to strip sensitive headers on cross-origin redirects. Version 13.3.12 lacks this function entirely and creates fresh requests with URL-only when handling redirects, preventing header leakage."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/localize@13.3.12-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9866c4a7-3400-55db-9881-b10594e9a4a3",
      "id": "CVE-2026-54265",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54265 does not affect version 13.3.12-tuxcare.1 of @angular/localize. not_affected \u2014 Angular v13.3.12-tuxcare.1 is not affected by CVE-2026-54265. The vulnerability is specific to the Ivy template pipeline architecture (TwoWayProperty operation) introduced in Angular v17+. This version uses an older Ivy architecture where two-way bindings desugar through the same sanitized property binding path as one-way bindings, preventing the sanitization bypass."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/localize@13.3.12-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:65bab117-2f9f-568b-9d18-f1fe40624147",
      "id": "CVE-2026-54266",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54266 does not affect version 13.3.12-tuxcare.1 of @angular/localize. not_affected \u2014 Angular v13.3.12 is NOT AFFECTED by CVE-2026-54266. The vulnerable HttpTransferCache feature with weak DJB2 hash-based cache key generation was introduced in Angular v16.0.0-next.7 (March 2023), which is 3+ major versions newer than this target version. Exhaustive code analysis confirms the transfer_cache.ts module, HttpTransferCache class, generateHash function, and all related cache key gener..."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/localize@13.3.12-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4b8b37ef-cda6-5ed5-b38b-8abb0cb3b5ae",
      "id": "CVE-2026-54267",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54267 affects version 13.3.12-tuxcare.1 of @angular/localize."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/localize@13.3.12-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f26f6b42-beef-56a5-9d32-38c6c6f11bce",
      "id": "CVE-2026-54268",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54268 affects version 13.3.12-tuxcare.1 of @angular/localize."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40angular/localize@13.3.12-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/localize@13.3.12-tuxcare.1"
    }
  ]
}