{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9b408af3-dbe0-5c14-97f4-ae5702ba6a77", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16", "type": "library", "name": "@angular/forms", "version": "5.2.11-tuxcare.16", "purl": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:42c36d69-c5dc-5a4c-b608-a03a88de59fe", "id": "CVE-2021-4231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.2.11-tuxcare.16 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:e6c38d23-72a1-520a-9de5-7a03928b60fc", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.2.11-tuxcare.16 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:a35bac54-f3c3-5f9f-8474-5dedd93e985f", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.2.11-tuxcare.16 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:be13f4f7-9581-5c23-9cf0-cd66312f4cae", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.11-tuxcare.16 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:10dd2daf-3d8b-5ed8-a4b8-f34fdc02f7a2", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.2.11-tuxcare.16 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:e03a3ae2-a85a-5e7c-b998-d14026389729", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 5.2.11-tuxcare.16 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:241fafe4-c1e5-5fda-8b53-0363fd5408d5", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.2.11-tuxcare.16 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:71de9a07-60b0-5819-9a09-fab31d2cf547", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.2.11-tuxcare.16 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:e7337f96-c4b5-5aff-a3d3-b01b73ff514e", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.2.11-tuxcare.16 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:c83a31d5-3cd9-5311-9c30-8b31956e9c32", "id": "CVE-2026-50170", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 5.2.11-tuxcare.16 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:0ddeba65-d684-5297-8632-c97dc55402b0", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.2.11-tuxcare.16 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:e8628a23-42af-5372-b878-d77faebe0644", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.2.11-tuxcare.16 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:2b42ffa2-3193-5c92-8217-0ada6b8dc7e5", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.2.11-tuxcare.16 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:a7e163fe-1923-52b3-b993-4120a59ba67c", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.2.11-tuxcare.16 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:883d20c0-6e8d-53c8-853c-cd1250da1765", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.2.11-tuxcare.16 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:ea14c39e-9f1a-5472-ae9e-76811c88b21a", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.2.11-tuxcare.16 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:70e02f06-1f4e-59b0-807b-35183b9c0e28", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 5.2.11-tuxcare.16 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:b089b571-c710-515d-b40f-d41c73e5afe6", "id": "CVE-2026-54265", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 5.2.11-tuxcare.16 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:93132b83-3bf7-5c9b-84d1-95189a67514a", "id": "CVE-2026-54266", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 5.2.11-tuxcare.16 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:7baa5000-3e38-5336-9b46-7e0ac9345a70", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.2.11-tuxcare.16 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:ecd4094e-1ac1-5aac-9191-4c5872d06a2d", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.2.11-tuxcare.16 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:648f6868-b2ab-5627-820c-cc50f4c7ddb7", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.16 of @angular/forms. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne..." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:6a11b5b4-d945-5625-896d-a0b1432ffe44", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.2.11-tuxcare.16 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:4dd1e896-aed0-5e11-9d8b-526f290b7c73", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 5.2.11-tuxcare.16 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:e8266495-d5ff-56ad-bb21-bd019a05f7fd", "id": "CVE-2026-88056", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.16 of @angular/forms. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur..." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:97fc7332-f9f5-5a0d-a97e-40e1d24a0131", "id": "CVE-2026-88057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 5.2.11-tuxcare.16 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:9258c522-e863-55e0-abfb-f7b8ac8c747f", "id": "CVE-2026-88059", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.16 of @angular/forms. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat..." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }, { "bom-ref": "urn:uuid:411413fe-0c3f-54b0-8512-74314c106c98", "id": "CVE-2026-88060", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 5.2.11-tuxcare.16 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.16" } ] }