{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:16680478-4f0e-5ba6-8033-c7726fac4797",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "dompurify",
      "purl": "pkg:npm/dompurify@3.3.3-tuxcare.1",
      "type": "library",
      "bom-ref": "pkg:npm/dompurify@3.3.3-tuxcare.1",
      "version": "3.3.3-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "dompurify",
            "purl": "pkg:npm/dompurify@3.3.3",
            "type": "library",
            "version": "3.3.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-41238",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.3.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d276c9d5-423e-59fe-9d5f-47b179976234",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41238 affects version 3.3.3-tuxcare.1 of dompurify, and is fixed in 3.3.3-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-41239",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.3.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c02e4c8c-37b4-5b5f-865c-ef7adc0b5a7c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41239 affects version 3.3.3-tuxcare.1 of dompurify, and is fixed in 3.3.3-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-41240",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.3.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d7dae634-5e5e-50d4-8fc7-d860ee8dc2c2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41240 affects version 3.3.3-tuxcare.1 of dompurify, and is fixed in 3.3.3-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-49458",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.3.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bf3e821a-b45a-58d7-97eb-0e99310bce27",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-49458 affects version 3.3.3-tuxcare.1 of dompurify, and is fixed in 3.3.3-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-49459",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.3.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:015f932c-688c-5566-b245-615ebe485feb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-49459 affects version 3.3.3-tuxcare.1 of dompurify, and is fixed in 3.3.3-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-49978",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.3.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1c8ca1dd-5e59-5d76-a7bf-f2232c629287",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-49978 affects version 3.3.3-tuxcare.1 of dompurify, and is fixed in 3.3.3-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-65898",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.3.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e3bff797-5f72-5064-ba3f-e0d5d35cc915",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65898 affects version 3.3.3-tuxcare.1 of dompurify, and is fixed in 3.3.3-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-65899",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.3.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ec2deb67-c22a-5b4c-82dd-cf5ae01d2b70",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65899 affects version 3.3.3-tuxcare.1 of dompurify, and is fixed in 3.3.3-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-65900",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.3.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0a61f73a-217e-5da1-a76d-0628f00255b9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65900 affects version 3.3.3-tuxcare.1 of dompurify, and is fixed in 3.3.3-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-65901",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.3.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fdb90685-11f3-5395-8585-742400a845be",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65901 affects version 3.3.3-tuxcare.1 of dompurify, and is fixed in 3.3.3-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-65902",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.3.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c6681af8-3116-554f-962e-c3bfe4d58355",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65902 affects version 3.3.3-tuxcare.1 of dompurify, and is fixed in 3.3.3-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-65903",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.3.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fe521bde-39f0-5d13-90be-49644dc35d11",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65903 affects version 3.3.3-tuxcare.1 of dompurify, and is fixed in 3.3.3-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-66010",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.3.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fba52540-3cba-5757-8d26-40ee8637e786",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-66010 affects version 3.3.3-tuxcare.1 of dompurify, and is fixed in 3.3.3-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-75838",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.3.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ec3ed39c-93a8-55a0-8870-b5ec51079e55",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-75838 affects version 3.3.3-tuxcare.1 of dompurify, and is fixed in 3.3.3-tuxcare.3."
      }
    },
    {
      "id": "GHSA-55q2-fjhq-7xh7",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.3.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:08031594-f18e-5f55-a180-6c20929fbb4e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.3.3-tuxcare.1 of dompurify."
      }
    },
    {
      "id": "GHSA-6688-9rhm-gjv2",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.3.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0df43725-82a1-5ff7-9256-8eb0f5c5f006",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.3.3-tuxcare.1 of dompurify."
      }
    },
    {
      "id": "GHSA-c6gr-qvv4-5v3f",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.3.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9b0a77f2-994a-5751-b228-5e5d663d74ec",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.3.3-tuxcare.1 of dompurify, and is fixed in 3.3.3-tuxcare.4."
      }
    },
    {
      "id": "GHSA-jxrp-r7gx-q4j8",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.3.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c07b432d-0a80-5129-a82c-1406e67429c1",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.3.3-tuxcare.1."
      }
    },
    {
      "id": "GHSA-mrv2-3pqr-j5jr",
      "affects": [
        {
          "ref": "pkg:npm/dompurify@3.3.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a63bf2b5-04dd-5efd-b09a-ce0d554bad5b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.3.3-tuxcare.1 of dompurify."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/dompurify@3.3.3-tuxcare.1"
    }
  ]
}