{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c57f6ea6-15d4-5f2a-910f-efd6eb28bc60", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17", "type": "library", "name": "@angular/forms", "version": "5.2.11-tuxcare.17", "purl": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:2ffb4249-6481-5936-b965-3ef4286562f5", "id": "CVE-2021-4231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 5.2.11-tuxcare.17 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:11dc5a6b-a85f-5bf2-b12f-7eb64ed6692c", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 5.2.11-tuxcare.17 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:88672e38-96b4-5a65-af73-13d428cb71ea", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 5.2.11-tuxcare.17 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:c702bf4c-e636-57a2-800a-ed9132e40def", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 5.2.11-tuxcare.17 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:d53f8804-a009-5ac9-af09-bc32fb6710d8", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 5.2.11-tuxcare.17 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:62dfc70b-b15f-57df-b270-96fcc667317d", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 5.2.11-tuxcare.17 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:8bfe577b-f039-5f62-b2b3-b47b4543ebf4", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 5.2.11-tuxcare.17 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:2cdef7a4-84a8-57e2-a691-3407e0493583", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 5.2.11-tuxcare.17 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:5da6c839-1c7e-5510-8825-10886c020dd4", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 5.2.11-tuxcare.17 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:fb352c3d-3eec-52f5-9152-e9491ea20fd8", "id": "CVE-2026-50170", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 5.2.11-tuxcare.17 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:08e321dd-b489-5494-8586-dd92933e1539", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 5.2.11-tuxcare.17 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:001a8ea5-8078-5a3b-be7a-0d091bebfb96", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 5.2.11-tuxcare.17 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:26277dba-b79c-59a3-8c06-160e3cca8bb1", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 5.2.11-tuxcare.17 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:cc15d391-ecde-5898-bfbb-7325d980d057", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 5.2.11-tuxcare.17 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:13b444bc-3b4e-53f4-897a-f089b19406cb", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 5.2.11-tuxcare.17 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:b20e7426-0ebf-5f90-ad2f-6a7c6b7fd3f1", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 5.2.11-tuxcare.17 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:24576cb8-6ba1-5c2e-865a-8d3809798edb", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 5.2.11-tuxcare.17 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:5a86ec03-f18e-5824-a307-a765f7003406", "id": "CVE-2026-54265", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 5.2.11-tuxcare.17 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:fbe04eaa-424a-5879-a719-e0f6468a70ea", "id": "CVE-2026-54266", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 5.2.11-tuxcare.17 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:ecc9d5cf-e64e-5107-9d44-7befe81bac4d", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 5.2.11-tuxcare.17 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:db5e0a1a-8a61-5ff4-9c23-80bd2341693b", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 5.2.11-tuxcare.17 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:19ebf97c-1d4e-599a-882f-a255701add30", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 5.2.11-tuxcare.17 of @angular/forms. not_affected \u2014 Angular 5.2.11 is NOT affected by CVE-2026-68945. The vulnerable component `HttpTransferCache` does not exist in this version. This feature was introduced in Angular v16 as part of the modern SSR hydration system. Angular 5.2.11 only has the basic `TransferState` API (a generic key-value store for manual state transfer), not the automatic HTTP request caching interceptor that contains the vulne..." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:8c295a43-e04a-57fa-b239-27ed5b21fe19", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 5.2.11-tuxcare.17 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:57b56f54-eacd-5beb-8b6c-1e21885667b2", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 5.2.11-tuxcare.17 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:b1083db8-a60f-5202-843a-23b69b8d0f03", "id": "CVE-2026-88056", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 5.2.11-tuxcare.17 of @angular/forms. not_affected \u2014 Angular 5.2.11-tuxcare.19 does not contain the vulnerable URL resolution code pattern described in CVE-2026-88056. The vulnerability requires the url.ts file with parseUrl function calling String.prototype.trim() and the relativeUrlsTransformerInterceptorFn HTTP interceptor, both introduced in later Angular versions (post-June 2026). The target version uses a fundamentally different architectur..." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:cfdf3a68-4c48-503c-b8ba-2b158da9176d", "id": "CVE-2026-88057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 5.2.11-tuxcare.17 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:25c5aa79-d7ef-537b-a4b5-d3aee51bcef1", "id": "CVE-2026-88059", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 5.2.11-tuxcare.17 of @angular/forms. not_affected \u2014 Angular 5.2.11 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache with hierarchical HttpClient delegation (withRequestsMadeViaParent()), features that were introduced in Angular v16. Angular 5.2.11 predates these features by approximately 6+ years and contains only a basic HTTP interceptor architecture with no automatic response caching mechanism. While TransferStat..." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:71a7372b-3a55-5b48-80f4-c8f6c0e085e4", "id": "CVE-2026-88060", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 5.2.11-tuxcare.17 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/forms@5.2.11-tuxcare.17" } ] }