{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1cb9ee69-b098-5ce1-a59b-4b43b33fcd8f", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11", "type": "library", "name": "@angular/forms", "version": "6.1.10-tuxcare.11", "purl": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:f4c9965c-7ac3-5752-967d-9542c8c39e73", "id": "CVE-2021-4231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 6.1.10-tuxcare.11 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:34b60758-fac9-59c4-86bc-9730ddf54132", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 6.1.10-tuxcare.11 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:631cfee1-0213-57d7-9a47-cde850c088f2", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 6.1.10-tuxcare.11 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:623e2483-528a-5cf3-86bd-58e71b144683", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 6.1.10-tuxcare.11 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:a2ebcddc-323b-5092-8929-8042e6aa99c2", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 6.1.10-tuxcare.11 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:f133668f-1682-5812-83a3-b2bf8f1a4646", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 6.1.10-tuxcare.11 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:ecaa52cd-20d2-5d7f-b97d-82cc5b8fc264", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 6.1.10-tuxcare.11 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:8d54e7a0-ef51-5a07-bcd7-f1b7054e7866", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 6.1.10-tuxcare.11 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:1ef211a6-7d41-5ae0-9824-709e41a77a1d", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 6.1.10-tuxcare.11 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:ffe9cdb4-608e-56b8-ac04-e0a79ff8f006", "id": "CVE-2026-50170", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 6.1.10-tuxcare.11 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:608a5f3e-5614-5801-bdbd-a086fc8a2d0f", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 6.1.10-tuxcare.11 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:6a2bdca9-2021-5d0b-b750-d8852b847830", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 6.1.10-tuxcare.11 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:75471b99-9eff-5c25-9cbb-a77525843932", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 6.1.10-tuxcare.11 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0de72d5e-ee7d-5b2f-a1ec-ed59ee86bbc9", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 6.1.10-tuxcare.11 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:073b1590-b3e5-5520-9402-9e895a63527e", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 6.1.10-tuxcare.11 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:e88467d1-ae3c-52bf-9924-78a1ed59071c", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 6.1.10-tuxcare.11 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:a233c856-04fa-5a98-ab96-85835cbd2bc6", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 6.1.10-tuxcare.11 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:ea33fd6f-2dd0-591d-beac-2ec90b7017ec", "id": "CVE-2026-54265", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 6.1.10-tuxcare.11 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:e62099b0-726d-5bc5-a50b-1cf3ca1e549c", "id": "CVE-2026-54266", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 6.1.10-tuxcare.11 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:83c5fd04-4685-5d75-8c5c-cf2cbfb9598b", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 6.1.10-tuxcare.11 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:b4d82db4-56a3-5367-8ba3-3b013b585309", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 6.1.10-tuxcare.11 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:49607981-6300-5a11-93a8-b7fd8a23c0ba", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 6.1.10-tuxcare.11 of @angular/forms. not_affected \u2014 Angular 6.1.10 is NOT AFFECTED by CVE-2026-68945. The vulnerable HttpTransferCache feature does not exist in this version \u2014 it was introduced in Angular 16.0.0 (April 2023), more than 5 years after Angular 6.1.10 (2018). The vulnerable file `packages/common/http/src/transfer_cache.ts` and all related APIs (`provideClientHydration`, `withNoHttpTransferCache`, `sortAndConcatParams`) are completel..." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:d3ff8ae7-3921-546b-bcc1-2da862d18f9e", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 6.1.10-tuxcare.11 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:1612f83a-bb55-504c-9717-9bb95307bb8c", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 6.1.10-tuxcare.11 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:c85edf8e-6d75-534e-8bcb-799e10e57d47", "id": "CVE-2026-88056", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 6.1.10-tuxcare.11 of @angular/forms. not_affected \u2014 Angular version 6.1.10 is not affected by CVE-2026-88056. The vulnerable code pattern (url.ts with parseUrl using String.prototype.trim() and relativeUrlsTransformerInterceptorFn interceptor) does not exist in this version. These components were introduced in later Angular versions (post-6.1.10) and subsequently fixed in August 2026. Version 6.1.10 predates the vulnerable SSR URL resolution arc..." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:e47909c0-4cb9-5af5-9414-d4cd59f95f38", "id": "CVE-2026-88057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 6.1.10-tuxcare.11 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:78ead662-f90d-5583-8644-853aeb5347ae", "id": "CVE-2026-88059", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 6.1.10-tuxcare.11 of @angular/forms. not_affected \u2014 Angular 6.1.10 is not affected by CVE-2026-88059. The vulnerable HttpTransferCache feature, withRequestsMadeViaParent() delegation API, and modern hydration system (provideClientHydration()) do not exist in this version. These components were introduced in Angular 16+ (circa 2023), while the target version is from Angular 6 (2018). The vulnerability requires automatic HTTP response caching duri..." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:400eb4d3-1cb0-55d0-a11e-d7f192817f57", "id": "CVE-2026-88060", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 6.1.10-tuxcare.11 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.11" } ] }