{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7d7a56cc-28b8-54cc-8cb0-ecf52a31b021", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14", "type": "library", "name": "@angular/forms", "version": "5.2.11-tuxcare.14", "purl": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:f131d9ea-ecf9-5973-b35c-3dce655396ca", "id": "CVE-2021-4231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.2.11-tuxcare.14 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:b010049e-32e9-558a-b249-2556a70eb057", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.2.11-tuxcare.14 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:7b8494a9-5988-56b5-93e3-1f87e774ecfe", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.2.11-tuxcare.14 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:bcf25dc6-166c-5766-9568-f171ea0e5fe2", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.11-tuxcare.14 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:6310b957-80d2-54e8-a6b9-89bef2d7f28d", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.2.11-tuxcare.14 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:df0810ff-34db-523f-b3d2-d439ce3d6ee0", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 5.2.11-tuxcare.14 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:c2193c56-92ef-5a34-b256-fecf9911111b", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.2.11-tuxcare.14 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:1bae9cf7-91a1-5c17-8fa0-3abd7c8bfeee", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.2.11-tuxcare.14 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:c772e7bc-6ca7-5ccc-96a8-807b3c984ea6", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.2.11-tuxcare.14 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:3150469a-7dae-55cf-abbe-8d80c1b7a4e1", "id": "CVE-2026-50170", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 5.2.11-tuxcare.14 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:6bbf7c79-6f36-595b-b94e-650b95ce6478", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.2.11-tuxcare.14 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:dc187444-abfc-55e6-9927-a34058b9edb7", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.2.11-tuxcare.14 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:8d8567e0-8d80-5823-96d8-754a1693518d", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.2.11-tuxcare.14 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:8697c1ba-3fbe-5dea-a04c-f3750cd51ae8", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.2.11-tuxcare.14 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:ecf856f6-1fa2-5c2d-aaa3-449e222bb6ba", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.2.11-tuxcare.14 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:28e911be-bd82-5dbb-8a54-d27aa0103d86", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.2.11-tuxcare.14 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:568ef104-07a9-5571-938c-36c1883c48c4", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 5.2.11-tuxcare.14 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:15d79395-d4fe-5d83-844c-c28e99f1a54e", "id": "CVE-2026-54265", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 5.2.11-tuxcare.14 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:7d52f62c-e8c0-51a3-a1dd-16e7c5614306", "id": "CVE-2026-54266", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 5.2.11-tuxcare.14 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:2e745be6-4c56-571b-85e2-21b48e829a76", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.2.11-tuxcare.14 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:c3840308-2683-564f-bcc8-8fdb7f3ec902", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.2.11-tuxcare.14 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:3de0e30f-68b1-5158-b0cb-44b6bb98818c", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.14 of @angular/forms. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne..." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:974d538a-c445-5298-8fca-031826e1a6ae", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.2.11-tuxcare.14 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:5881daf6-9ba3-5fa2-a17d-5b67f52b9462", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 5.2.11-tuxcare.14 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:d4c31c96-0c09-5c44-938f-600009ae8407", "id": "CVE-2026-88056", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.14 of @angular/forms. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur..." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:481e6e1c-9489-5163-9db1-3cd036c3beb7", "id": "CVE-2026-88057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 5.2.11-tuxcare.14 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:382f4ee3-e91b-5b34-9879-12277c020f35", "id": "CVE-2026-88059", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.14 of @angular/forms. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat..." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }, { "bom-ref": "urn:uuid:5210d8d2-f49e-5672-90de-7d1885742a38", "id": "CVE-2026-88060", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 5.2.11-tuxcare.14 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.14" } ] }