<?xml version="1.0" encoding="UTF-8"?>
<bom xmlns="http://cyclonedx.org/schema/bom/1.2" xmlns:v="http://cyclonedx.org/schema/ext/vulnerability/1.0" version="1" serialNumber="urn:uuid:5eadecca-0f28-4921-b71a-f0e62398f8ef">
  <metadata>
    <timestamp>2022-06-09T23:40:38Z</timestamp>
    <tools>
      <tool>
        <vendor>anchore</vendor>
        <name>grype</name>
        <version>[not provided]</version>
      </tool>
    </tools>
    <component type="file">
      <name>/some/path</name>
      <version></version>
    </component>
  </metadata>
  <components>
    <component type="library">
      <name>package-1</name>
      <version>1.0.1</version>
      <v:vulnerabilities>
        <v:vulnerability ref="urn:uuid:60c1e44a-2318-45b0-a8d0-7d4d510c3c59">
          <v:id>CVE-1999-0001</v:id>
          <v:source name="source-1">
            <v:url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0001</v:url>
          </v:source>
          <v:ratings>
            <v:rating>
              <v:severity>Low</v:severity>
            </v:rating>
            <v:rating>
              <v:score>
                <v:base>4</v:base>
                <v:impact>0</v:impact>
                <v:exploitability>0</v:exploitability>
              </v:score>
              <v:method>CVSSv3</v:method>
              <v:vector>another vector</v:vector>
            </v:rating>
          </v:ratings>
          <v:description>1999-01 description</v:description>
          <v:advisories></v:advisories>
        </v:vulnerability>
      </v:vulnerabilities>
    </component>
    <component type="library">
      <name>package-2</name>
      <version>2.0.1</version>
      <licenses>
        <license>
          <name>MIT</name>
        </license>
        <license>
          <name>Apache-v2</name>
        </license>
      </licenses>
      <v:vulnerabilities>
        <v:vulnerability ref="urn:uuid:c7b09c89-9962-4f1f-b607-9eff52105113">
          <v:id>CVE-1999-0002</v:id>
          <v:source name="source-2">
            <v:url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0002</v:url>
          </v:source>
          <v:ratings>
            <v:rating>
              <v:severity>Critical</v:severity>
            </v:rating>
            <v:rating>
              <v:score>
                <v:base>1</v:base>
                <v:impact>3</v:impact>
                <v:exploitability>2</v:exploitability>
              </v:score>
              <v:method>CVSSv2</v:method>
              <v:vector>vector</v:vector>
            </v:rating>
          </v:ratings>
          <v:description>1999-02 description</v:description>
          <v:advisories></v:advisories>
        </v:vulnerability>
      </v:vulnerabilities>
    </component>
  </components>
</bom>