{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8d6c4891-922d-5532-a980-190f1a04e780",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "framework",
      "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare",
      "type": "library",
      "group": "laravel",
      "bom-ref": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare",
      "version": "11.44.0-p3+tuxcare",
      "pedigree": {
        "ancestors": [
          {
            "name": "framework",
            "purl": "pkg:composer/laravel/framework@11.44.0",
            "type": "library",
            "group": "laravel",
            "version": "11.44.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-27515",
      "affects": [
        {
          "ref": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:a351f35e-93b3-5f3d-9cc0-2c588d385643",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-27515 is fixed in version 11.44.0-p3+tuxcare of laravel/framework."
      }
    },
    {
      "id": "CVE-2026-102279",
      "affects": [
        {
          "ref": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:7bdced09-70f1-5a6b-9be4-6b9978b78722",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-102279 does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is NOT affected by CVE-2026-102279. The vulnerability (DOM-based XSS via Tippy.js tooltips with allowHTML: true) was introduced in Laravel 12.x and never existed in version 11.x. The target uses Tippy.js v6.3.7 without setting allowHTML, relying on the library's safe default (allowHTML: false), which prevents HTML interpretation in tooltips. Although attacker-controlled input (H...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-114509",
      "affects": [
        {
          "ref": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:f32510c1-421e-5471-9ced-3d37d5b3d857",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-114509 affects version 11.44.0-p3+tuxcare of laravel/framework, and is fixed in 11.44.0-p4+tuxcare."
      }
    },
    {
      "id": "CVE-2026-24765",
      "affects": [
        {
          "ref": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:e7da300b-7ade-529e-b837-741fb69a1f5b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-24765 does not affect version 11.44.0-p3+tuxcare of laravel/framework. CVE-2026-24765 pertains to phpunit, not laravel/framework. Tracked on the phpunit VPV.",
        "justification": "requires_dependency"
      }
    },
    {
      "id": "GHSA-5vg9-5847-vvmq",
      "affects": [
        {
          "ref": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:f7fffccd-6951-582c-9b97-ce86ae8dc522",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 11.44.0-p3+tuxcare of laravel/framework."
      }
    },
    {
      "id": "GHSA-crmm-hgp2-wgrp",
      "affects": [
        {
          "ref": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:ea54901a-b5b6-5eff-a1be-613b6add0200",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 11.44.0-p3+tuxcare of laravel/framework."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare"
    }
  ]
}