{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:750efc5e-3c01-5c97-8858-611b750eeddc", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/forms@15.2.2-tuxcare.3", "type": "library", "name": "@angular/forms", "version": "15.2.2-tuxcare.3", "purl": "pkg:npm/%40angular/forms@15.2.2-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:1045ac76-97ac-51d6-9a21-99d44d478ae6", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 15.2.2-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c1f5d546-aca2-58e4-b2e4-ecfa12fbc507", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 15.2.2-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5e5ca592-da38-5597-8824-8398353242cf", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 15.2.2-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c360fd18-5478-5796-9fe2-a5661937b7fc", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 15.2.2-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:aab88d3c-cbd1-5311-97e0-03ad0f8df720", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 15.2.2-tuxcare.3 of @angular/forms. not_affected \u2014 The target repository (Angular 15.2.2-tuxcare.1) is NOT affected by CVE-2026-41423. While the target lacks the specific fix from the upstream patch, it uses a fundamentally different URL parsing mechanism (Node.js legacy url.parse()) that does not exhibit the WHATWG URL specification behavior exploited in the vulnerability." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9e11b93f-7d10-58a5-915b-d44af4808ef0", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 15.2.2-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9d87885c-087c-524b-bad9-2d553a37e7c3", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 15.2.2-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:07c99477-5b4f-5793-bd36-40ec6ad6de4c", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 15.2.2-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0cb9ccc9-da39-5cc5-a558-b0454e1f143b", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 15.2.2-tuxcare.3 of @angular/forms. not_affected \u2014 Angular v15.2.2 is not affected by CVE-2026-50170. The HTTP TransferCache feature, which is the subject of the vulnerability, was introduced in Angular v16.0.0 (March 2023). The target repository version (15.2.2-tuxcare.1) predates this feature entirely and does not contain the vulnerable code path." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:90a60382-3cc8-5a56-b383-2d14984c1b51", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 15.2.2-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:61d2a88d-3125-567b-a604-69263937fa1e", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 15.2.2-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f25bbb49-e619-53d8-8b3c-d6b14b3cbbc8", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 15.2.2-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cb290543-7b35-56cf-8ac3-d8a641048bc0", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 15.2.2-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ccc9bce6-5c2e-5b79-8ece-f8ceb22110b7", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 15.2.2-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:259f8c31-51f9-50bc-b5f2-83481fa9d707", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 15.2.2-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:51bb4d67-515d-5205-8f57-a3b2c675ee58", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 15.2.2-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:41cf8167-4a65-5fff-b4f4-e1809e2ffae8", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 15.2.2-tuxcare.3 of @angular/forms. not_affected \u2014 Angular v15.2.2 does not contain the vulnerable code path. The CVE-2026-54265 vulnerability affects the template pipeline's resolve_sanitizers.ts (TwoWayProperty operation), which does not exist in v15.2.2. This version uses TemplateDefinitionBuilder where two-way bindings desugar to regular property bindings that receive identical sanitization as one-way bindings." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0df38b8d-595b-5548-8c5e-f09ebae81add", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 15.2.2-tuxcare.3 of @angular/forms. not_affected \u2014 Angular 15.2.2 is not affected by CVE-2026-54266. The vulnerable HttpTransferCache feature was introduced in Angular 16.0.0 (May 2023), after this version was released (March 2023). The target codebase does not contain the transfer_cache.ts module, HttpTransferCache API, or any HTTP response caching mechanism that uses hash-based cache keys." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8d9e4602-99d9-5a04-afa6-2312341b3a99", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 15.2.2-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1c73e5e4-56f0-5480-b146-6e19f5ad5db7", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 15.2.2-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:17cb9526-6fff-5731-b2d6-37a26613e611", "id": "CVE-2026-68945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 15.2.2-tuxcare.3 of @angular/forms. not_affected \u2014 Angular 15.2.2-tuxcare.2 is not affected by CVE-2026-68945. The vulnerable HttpTransferCache feature does not exist in this version\u2014it was introduced in Angular 16.0.0, after the target's release. Without HttpTransferCache, the cache-key collision vulnerability described in the CVE (where repeated HTTP parameters like `role=user&role=admin` collide with scalar-comma parameters like `role=user,a..." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:faeb9c13-80cb-5a2c-b9e0-4a118da093de", "id": "CVE-2026-69149", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 15.2.2-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@15.2.2-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:eee16b04-cffa-5e4e-89da-0dd2938bd36e", "id": "CVE-2026-69151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 15.2.2-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@15.2.2-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/forms@15.2.2-tuxcare.3" } ] }