{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:21c5f225-29aa-5cc4-8279-58ecfdcb24fc", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15", "type": "library", "name": "@angular/forms", "version": "5.2.11-tuxcare.15", "purl": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:c6ba7316-c761-5e11-ba94-a5a9c64c7620", "id": "CVE-2021-4231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.2.11-tuxcare.15 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:3baa8baa-0e1e-540e-99ed-de1df2aa73f4", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.2.11-tuxcare.15 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:dd86d50c-619b-5d12-b119-685e18b82a5a", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.2.11-tuxcare.15 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:96ad9765-821d-5062-ab94-8bc174143335", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.11-tuxcare.15 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:defde27b-843e-5a98-9fa0-38cef3c14ae7", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.2.11-tuxcare.15 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:e1d3c001-92b8-5606-a4bf-fe085d46b2a4", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 5.2.11-tuxcare.15 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:1428c7b1-3401-5de2-b831-45a144bbbf0a", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.2.11-tuxcare.15 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:11d68704-da0c-56ee-af96-205bcefbfa12", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.2.11-tuxcare.15 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:d4093a51-48b2-5338-969b-6935b8b30e41", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.2.11-tuxcare.15 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:be737459-2019-58ef-92f0-ba99ae4708ad", "id": "CVE-2026-50170", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 5.2.11-tuxcare.15 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:ac4a6ded-71c1-554a-bb84-9404ef0f512b", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.2.11-tuxcare.15 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:f3025bea-c52c-5ee4-b470-932fc4f99c8a", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.2.11-tuxcare.15 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:e565de2d-57b3-5662-8db6-ab85a709cefb", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.2.11-tuxcare.15 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:cc0f221d-d889-5119-a29a-ed4e621fcd6f", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.2.11-tuxcare.15 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:74e01de4-18a4-5a70-b88b-45aed8b6361b", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.2.11-tuxcare.15 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:87af29f7-8af7-50f3-a3f6-cdb678a7619f", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.2.11-tuxcare.15 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:fad3ec7f-be6d-53ea-a5a2-a1582bf0638f", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 5.2.11-tuxcare.15 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:3a382832-c9cb-5a79-843f-ae33c54238f5", "id": "CVE-2026-54265", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 5.2.11-tuxcare.15 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:6c30782f-3e6f-5a16-9c5f-a55f6b46bb1d", "id": "CVE-2026-54266", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 5.2.11-tuxcare.15 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:ffb403a9-4f90-5f4d-af7d-733f0f2a4d04", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.2.11-tuxcare.15 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:f34c1b58-98f3-5fdd-8183-8aca45905da7", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.2.11-tuxcare.15 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:bae1220c-16ea-51d5-82e3-f412d95d4c6b", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.15 of @angular/forms. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne..." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:d1555659-6fe1-56a9-9228-2c18e2f2194e", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.2.11-tuxcare.15 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:4b0baac0-9751-5c4c-99a1-bca29d8bc55b", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 5.2.11-tuxcare.15 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:64dbd320-9be2-54eb-9e7b-6204588a97b0", "id": "CVE-2026-88056", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.15 of @angular/forms. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur..." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:b11ef319-4958-5df6-909a-acd0c5cab81f", "id": "CVE-2026-88057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 5.2.11-tuxcare.15 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:1d0787eb-6e5c-50fb-a64c-a8faa7b1055e", "id": "CVE-2026-88059", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.15 of @angular/forms. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat..." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }, { "bom-ref": "urn:uuid:e590a134-3f43-520c-acae-3185f4dfb8cb", "id": "CVE-2026-88060", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 5.2.11-tuxcare.15 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.15" } ] }