{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "serialNumber": "urn:uuid:a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "version": 1,
  "metadata": {
    "timestamp": "2026-04-07T14:30:00Z",
    "tools": [
      {
        "vendor": "anchore",
        "name": "syft",
        "version": "1.4.1"
      }
    ],
    "component": {
      "type": "application",
      "name": "acme-webapp",
      "version": "2.8.1",
      "description": "ACME Corporation internal web application",
      "purl": "pkg:docker/acme-webapp@2.8.1"
    }
  },
  "components": [
    {
      "type": "library",
      "name": "express",
      "version": "4.18.2",
      "purl": "pkg:npm/express@4.18.2",
      "licenses": [{ "license": { "id": "MIT" } }],
      "hashes": [{ "alg": "SHA-256", "content": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2" }],
      "externalReferences": [{ "type": "website", "url": "https://expressjs.com" }]
    },
    {
      "type": "library",
      "name": "lodash",
      "version": "4.17.20",
      "purl": "pkg:npm/lodash@4.17.20",
      "licenses": [{ "license": { "id": "MIT" } }],
      "hashes": [{ "alg": "SHA-256", "content": "b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3" }],
      "properties": [{ "name": "note", "value": "VULNERABLE: CVE-2021-23337 — command injection via template(). Fix: upgrade to 4.17.21" }]
    },
    {
      "type": "library",
      "name": "jsonwebtoken",
      "version": "8.5.1",
      "purl": "pkg:npm/jsonwebtoken@8.5.1",
      "licenses": [{ "license": { "id": "MIT" } }],
      "hashes": [{ "alg": "SHA-256", "content": "c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4" }],
      "properties": [{ "name": "note", "value": "VULNERABLE: CVE-2022-23529 — JWT forgery via prototype pollution. Fix: upgrade to 9.0.0 (BREAKING)" }]
    },
    {
      "type": "library",
      "name": "axios",
      "version": "1.6.0",
      "purl": "pkg:npm/axios@1.6.0",
      "licenses": [{ "license": { "id": "MIT" } }],
      "hashes": [{ "alg": "SHA-256", "content": "d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5" }],
      "properties": [{ "name": "note", "value": "VULNERABLE: CVE-2023-45857 — XSRF-TOKEN cookie leak. Fix: upgrade to 1.6.2" }]
    },
    {
      "type": "library",
      "name": "follow-redirects",
      "version": "1.15.4",
      "purl": "pkg:npm/follow-redirects@1.15.4",
      "licenses": [{ "license": { "id": "MIT" } }],
      "hashes": [{ "alg": "SHA-256", "content": "e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6" }],
      "properties": [{ "name": "note", "value": "VULNERABLE: CVE-2024-28849 — Authorization header leak on cross-origin redirect. Fix: 1.15.6" }]
    },
    {
      "type": "library",
      "name": "xml2js",
      "version": "0.4.23",
      "purl": "pkg:npm/xml2js@0.4.23",
      "licenses": [{ "license": { "id": "MIT" } }],
      "hashes": [{ "alg": "SHA-256", "content": "f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1" }],
      "properties": [{ "name": "note", "value": "VULNERABLE: CVE-2023-0842 — prototype pollution via __proto__ in parsed XML. Fix: 0.5.0 (BREAKING)" }]
    },
    {
      "type": "library",
      "name": "helmet",
      "version": "7.1.0",
      "purl": "pkg:npm/helmet@7.1.0",
      "licenses": [{ "license": { "id": "MIT" } }],
      "hashes": [{ "alg": "SHA-256", "content": "a1a2b3c4d5e6f7a1a2b3c4d5e6f7a1a2b3c4d5e6f7a1a2b3c4d5e6f7a1a2b3c4" }]
    },
    {
      "type": "library",
      "name": "cors",
      "version": "2.8.5",
      "purl": "pkg:npm/cors@2.8.5",
      "licenses": [{ "license": { "id": "MIT" } }],
      "hashes": [{ "alg": "SHA-256", "content": "b2b3c4d5e6f7a1b2b3c4d5e6f7a1b2b3c4d5e6f7a1b2b3c4d5e6f7a1b2b3c4d5" }]
    },
    {
      "type": "library",
      "name": "winston",
      "version": "3.11.0",
      "purl": "pkg:npm/winston@3.11.0",
      "licenses": [{ "license": { "id": "MIT" } }],
      "hashes": [{ "alg": "SHA-256", "content": "c3c4d5e6f7a1b2c3c4d5e6f7a1b2c3c4d5e6f7a1b2c3c4d5e6f7a1b2c3c4d5e6" }]
    },
    {
      "type": "library",
      "name": "mongoose",
      "version": "7.6.3",
      "purl": "pkg:npm/mongoose@7.6.3",
      "licenses": [{ "license": { "id": "MIT" } }],
      "hashes": [{ "alg": "SHA-256", "content": "d4d5e6f7a1b2c3d4d5e6f7a1b2c3d4d5e6f7a1b2c3d4d5e6f7a1b2c3d4d5e6f7" }]
    },
    {
      "type": "library",
      "name": "flask",
      "version": "3.0.0",
      "purl": "pkg:pypi/flask@3.0.0",
      "licenses": [{ "license": { "id": "BSD-3-Clause" } }],
      "hashes": [{ "alg": "SHA-256", "content": "e5e6f7a1b2c3d4e5e6f7a1b2c3d4e5e6f7a1b2c3d4e5e6f7a1b2c3d4e5e6f7a1" }]
    },
    {
      "type": "library",
      "name": "werkzeug",
      "version": "3.0.1",
      "purl": "pkg:pypi/werkzeug@3.0.1",
      "licenses": [{ "license": { "id": "BSD-3-Clause" } }],
      "hashes": [{ "alg": "SHA-256", "content": "f6f7a1b2c3d4e5f6f7a1b2c3d4e5f6f7a1b2c3d4e5f6f7a1b2c3d4e5f6f7a1b2" }],
      "properties": [{ "name": "note", "value": "VULNERABLE: CVE-2024-34069 — debugger RCE if enabled in production. Fix: 3.0.3" }]
    },
    {
      "type": "library",
      "name": "jinja2",
      "version": "3.1.2",
      "purl": "pkg:pypi/jinja2@3.1.2",
      "licenses": [{ "license": { "id": "BSD-3-Clause" } }],
      "hashes": [{ "alg": "SHA-256", "content": "a7a8b9c0d1e2f3a7a8b9c0d1e2f3a7a8b9c0d1e2f3a7a8b9c0d1e2f3a7a8b9c0" }],
      "properties": [{ "name": "note", "value": "VULNERABLE: CVE-2024-34064 — XSS via xmlattr filter. Fix: 3.1.4" }]
    },
    {
      "type": "library",
      "name": "pillow",
      "version": "9.5.0",
      "purl": "pkg:pypi/pillow@9.5.0",
      "licenses": [{ "license": { "id": "HPND" } }],
      "hashes": [{ "alg": "SHA-256", "content": "b8b9c0d1e2f3a4b8b9c0d1e2f3a4b8b9c0d1e2f3a4b8b9c0d1e2f3a4b8b9c0d1" }],
      "properties": [{ "name": "note", "value": "VULNERABLE: CVE-2023-44271 — DoS via crafted image. Fix: 10.0.1 (BREAKING)" }]
    },
    {
      "type": "library",
      "name": "cryptography",
      "version": "41.0.4",
      "purl": "pkg:pypi/cryptography@41.0.4",
      "licenses": [{ "license": { "id": "Apache-2.0" } }],
      "hashes": [{ "alg": "SHA-256", "content": "c9c0d1e2f3a4b5c9c0d1e2f3a4b5c9c0d1e2f3a4b5c9c0d1e2f3a4b5c9c0d1e2" }],
      "properties": [{ "name": "note", "value": "VULNERABLE: CVE-2024-26130 — NULL dereference on PKCS#7 load. Fix: 42.0.0 (BREAKING — requires OpenSSL 3.0+)" }]
    },
    {
      "type": "library",
      "name": "requests",
      "version": "2.31.0",
      "purl": "pkg:pypi/requests@2.31.0",
      "licenses": [{ "license": { "id": "Apache-2.0" } }],
      "hashes": [{ "alg": "SHA-256", "content": "d0d1e2f3a4b5c6d0d1e2f3a4b5c6d0d1e2f3a4b5c6d0d1e2f3a4b5c6d0d1e2f3" }],
      "properties": [{ "name": "note", "value": "VULNERABLE: CVE-2024-35195 — certificate verification bypass after verify=False. Fix: 2.32.0" }]
    },
    {
      "type": "library",
      "name": "gunicorn",
      "version": "21.2.0",
      "purl": "pkg:pypi/gunicorn@21.2.0",
      "licenses": [{ "license": { "id": "MIT" } }],
      "hashes": [{ "alg": "SHA-256", "content": "e1e2f3a4b5c6d7e1e2f3a4b5c6d7e1e2f3a4b5c6d7e1e2f3a4b5c6d7e1e2f3a4" }]
    },
    {
      "type": "library",
      "name": "celery",
      "version": "5.3.6",
      "purl": "pkg:pypi/celery@5.3.6",
      "licenses": [{ "license": { "id": "BSD-3-Clause" } }],
      "hashes": [{ "alg": "SHA-256", "content": "f2f3a4b5c6d7e8f2f3a4b5c6d7e8f2f3a4b5c6d7e8f2f3a4b5c6d7e8f2f3a4b5" }]
    },
    {
      "type": "library",
      "name": "redis",
      "version": "5.0.1",
      "purl": "pkg:pypi/redis@5.0.1",
      "licenses": [{ "license": { "id": "MIT" } }],
      "hashes": [{ "alg": "SHA-256", "content": "a3a4b5c6d7e8f9a3a4b5c6d7e8f9a3a4b5c6d7e8f9a3a4b5c6d7e8f9a3a4b5c6" }]
    },
    {
      "type": "library",
      "name": "sqlalchemy",
      "version": "2.0.23",
      "purl": "pkg:pypi/sqlalchemy@2.0.23",
      "licenses": [{ "license": { "id": "MIT" } }],
      "hashes": [{ "alg": "SHA-256", "content": "b4b5c6d7e8f9a0b4b5c6d7e8f9a0b4b5c6d7e8f9a0b4b5c6d7e8f9a0b4b5c6d7" }]
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-23337",
      "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23337" },
      "ratings": [{ "score": 7.2, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" }],
      "description": "Lodash template command injection",
      "recommendation": "Upgrade lodash to 4.17.21",
      "affects": [{ "ref": "pkg:npm/lodash@4.17.20" }]
    },
    {
      "id": "CVE-2022-23529",
      "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23529" },
      "ratings": [{ "score": 9.8, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }],
      "description": "jsonwebtoken insecure key retrieval allows JWT forgery",
      "recommendation": "Upgrade jsonwebtoken to 9.0.0",
      "affects": [{ "ref": "pkg:npm/jsonwebtoken@8.5.1" }]
    },
    {
      "id": "CVE-2023-45857",
      "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45857" },
      "ratings": [{ "score": 7.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }],
      "description": "Axios XSRF-TOKEN cookie leaked to arbitrary hosts",
      "recommendation": "Upgrade axios to 1.6.2",
      "affects": [{ "ref": "pkg:npm/axios@1.6.0" }]
    },
    {
      "id": "CVE-2024-28849",
      "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28849" },
      "ratings": [{ "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }],
      "description": "follow-redirects authorization header leak on cross-origin redirect",
      "recommendation": "Upgrade follow-redirects to 1.15.6",
      "affects": [{ "ref": "pkg:npm/follow-redirects@1.15.4" }]
    },
    {
      "id": "CVE-2023-0842",
      "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0842" },
      "ratings": [{ "score": 9.8, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }],
      "description": "xml2js prototype pollution via __proto__ key in parsed XML",
      "recommendation": "Upgrade xml2js to 0.5.0",
      "affects": [{ "ref": "pkg:npm/xml2js@0.4.23" }]
    },
    {
      "id": "CVE-2024-34069",
      "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34069" },
      "ratings": [{ "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }],
      "description": "Werkzeug debugger remote code execution when enabled in production",
      "recommendation": "Upgrade werkzeug to 3.0.3 and ensure debugger is disabled in production",
      "affects": [{ "ref": "pkg:pypi/werkzeug@3.0.1" }]
    },
    {
      "id": "CVE-2024-34064",
      "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34064" },
      "ratings": [{ "score": 5.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }],
      "description": "Jinja2 XSS via xmlattr filter",
      "recommendation": "Upgrade jinja2 to 3.1.4",
      "affects": [{ "ref": "pkg:pypi/jinja2@3.1.2" }]
    },
    {
      "id": "CVE-2023-44271",
      "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44271" },
      "ratings": [{ "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }],
      "description": "Pillow denial of service via uncontrolled resource consumption",
      "recommendation": "Upgrade pillow to 10.0.1",
      "affects": [{ "ref": "pkg:pypi/pillow@9.5.0" }]
    },
    {
      "id": "CVE-2024-26130",
      "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26130" },
      "ratings": [{ "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }],
      "description": "cryptography NULL dereference on PKCS#7 certificate load",
      "recommendation": "Upgrade cryptography to 42.0.0",
      "affects": [{ "ref": "pkg:pypi/cryptography@41.0.4" }]
    },
    {
      "id": "CVE-2024-35195",
      "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35195" },
      "ratings": [{ "score": 5.6, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N" }],
      "description": "requests session certificate verification bypass after verify=False",
      "recommendation": "Upgrade requests to 2.32.0",
      "affects": [{ "ref": "pkg:pypi/requests@2.31.0" }]
    }
  ]
}
