{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:bb452bdc-d877-569f-b995-3302e18c429b",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "dompurify",
      "purl": "pkg:npm/dompurify@3.1.4-tuxcare.1",
      "type": "library",
      "bom-ref": "pkg:npm/dompurify@3.1.4-tuxcare.1",
      "version": "3.1.4-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "dompurify",
            "purl": "pkg:npm/dompurify@3.1.4",
            "type": "library",
            "version": "3.1.4"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-15599",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.1.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b3f50810-6610-581c-89d5-dcb7ecdb21d7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-15599 affects version 3.1.4-tuxcare.1 of dompurify, and is fixed in 3.1.4-tuxcare.3."
      }
    },
    {
      "id": "CVE-2025-26791",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.1.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9b401719-317e-54c0-9f41-8d8647f04f05",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-26791 affects version 3.1.4-tuxcare.1 of dompurify, and is fixed in 3.1.4-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-0540",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.1.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:016dc612-7c26-59d0-9304-ef2685ef2a9b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-0540 affects version 3.1.4-tuxcare.1 of dompurify, and is fixed in 3.1.4-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-41238",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.1.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8856b05a-d358-5195-84d3-1e260cec6de7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41238 affects version 3.1.4-tuxcare.1 of dompurify, and is fixed in 3.1.4-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-41239",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.1.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8563a129-91ca-5a7e-a25c-0a898e5b585d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41239 affects version 3.1.4-tuxcare.1 of dompurify, and is fixed in 3.1.4-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-41240",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.1.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e9b2acec-9e4c-5eda-bedd-068c766f64d8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41240 affects version 3.1.4-tuxcare.1 of dompurify, and is fixed in 3.1.4-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-49458",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.1.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4db1c391-76d1-51c3-b6e4-11303694a49d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-49458 affects version 3.1.4-tuxcare.1 of dompurify, and is fixed in 3.1.4-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-49459",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.1.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:72540062-39be-5d6b-a508-8332e8bfa5ed",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-49459 affects version 3.1.4-tuxcare.1 of dompurify, and is fixed in 3.1.4-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-49978",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.1.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:585d4b9c-7d7e-5677-b0af-90c99af5c547",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-49978 affects version 3.1.4-tuxcare.1 of dompurify, and is fixed in 3.1.4-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-65898",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.1.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b1a865c7-8b63-5f39-a273-5f25c97c4a38",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65898 affects version 3.1.4-tuxcare.1 of dompurify, and is fixed in 3.1.4-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-65899",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.1.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ddbd02b4-8473-5c7f-b8ef-af91e7276fa3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65899 affects version 3.1.4-tuxcare.1 of dompurify, and is fixed in 3.1.4-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-65900",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.1.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:029192b4-7599-584f-85d6-0c979483bcf0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65900 affects version 3.1.4-tuxcare.1 of dompurify, and is fixed in 3.1.4-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-65901",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.1.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bba47836-8b29-57e3-8e3b-8f15d67ecc6c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65901 affects version 3.1.4-tuxcare.1 of dompurify, and is fixed in 3.1.4-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-65902",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.1.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:768b461a-074e-5164-9c35-cd882c4f48b8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65902 affects version 3.1.4-tuxcare.1 of dompurify, and is fixed in 3.1.4-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-65903",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.1.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:76d99b33-7344-55ac-b97b-105291a25e6f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65903 affects version 3.1.4-tuxcare.1 of dompurify, and is fixed in 3.1.4-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-65912",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.1.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6f06dccc-8b0d-5042-bdf3-dcd18c482c7c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65912 affects version 3.1.4-tuxcare.1 of dompurify, and is fixed in 3.1.4-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-65913",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.1.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bb54a7ba-196e-50bb-823f-ae482c7b684a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65913 affects version 3.1.4-tuxcare.1 of dompurify, and is fixed in 3.1.4-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-65914",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.1.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5bcf9603-9108-5754-96e9-9bc9f1d8cf05",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65914 affects version 3.1.4-tuxcare.1 of dompurify, and is fixed in 3.1.4-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-66010",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.1.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3bfd7a84-0339-5803-b746-ef68d30cabca",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-66010 affects version 3.1.4-tuxcare.1 of dompurify, and is fixed in 3.1.4-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-75838",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.1.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:be8f49ad-e012-5684-81a3-4d74ef2cdc6c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-75838 affects version 3.1.4-tuxcare.1 of dompurify, and is fixed in 3.1.4-tuxcare.2."
      }
    },
    {
      "id": "GHSA-55q2-fjhq-7xh7",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.1.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:67b2b73a-e4fe-5a1f-b545-f298e96c1a3e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.1.4-tuxcare.1 of dompurify."
      }
    },
    {
      "id": "GHSA-6688-9rhm-gjv2",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.1.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c3c56892-4d1d-5a64-8b22-b3286fe2d31c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.1.4-tuxcare.1 of dompurify."
      }
    },
    {
      "id": "GHSA-c6gr-qvv4-5v3f",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.1.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:99245bea-30c7-5366-b133-1d972ee84500",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.1.4-tuxcare.1 of dompurify, and is fixed in 3.1.4-tuxcare.4."
      }
    },
    {
      "id": "GHSA-jxrp-r7gx-q4j8",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.1.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:37f0c1d8-7337-5d2e-8d10-e25e2beb23da",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.1.4-tuxcare.1."
      }
    },
    {
      "id": "GHSA-mrv2-3pqr-j5jr",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.1.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c7330351-1845-5c6c-bc48-7d5b06621aa7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.1.4-tuxcare.1 of dompurify."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/dompurify@3.1.4-tuxcare.1"
    }
  ]
}