{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3370fd5f-91cb-58e6-bb36-73e59d0286f2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/forms", "purl": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5", "version": "16.2.11-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:fbed83ab-a1ca-5ff7-94a3-37fd48b71fca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:434470fd-e3a2-5f79-b9f9-d6f22043ef31", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:422889df-4cc8-53db-92de-1fa423f6c2d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:bd1b685a-e1f4-5ce3-b78b-6c4f0655a795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 16.2.11-tuxcare.5 of @angular/forms, and is fixed in 16.2.11-tuxcare.6." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:0b3d768e-b65d-550a-9542-64b79a1e7ffc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:7f665797-0175-5c6b-a5b0-40dce06c03c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:1c21bd32-e0e6-5f7a-8c6b-d4afe5e69cbd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:c7b3181d-5a36-562b-9645-d08148078bdf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:b59b151d-f036-5b19-929d-934c36a1abf3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:07f761d8-0cbd-5a3b-a314-49328065eceb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:27dee791-c7c6-5458-9164-c03dfb2a419a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:5e73b9df-b7f1-5412-b7a7-cb94b01ef659", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:7a4071f9-5788-527f-943a-90b50dbca063", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:0250e7f6-7735-5720-bda6-1afc4330ab3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:0ba9f21d-e62d-5afa-af09-201b6705e540", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:e62c0341-a968-5a4a-8698-cc058ca90518", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:4cfbeaa2-b4f7-5090-b7ab-b2a95a44ce36", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:f03226cd-ec4c-58ac-8124-713bb2d5cbea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:fcfcbf40-88eb-597b-b8b4-5d89e432ceb3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:d9e447a2-7afa-575e-84e5-3bd8b8c878d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:b08264db-61d7-5f5a-8166-730e0160017a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:799c2980-9511-578d-bada-a4d09bcf5952", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:72337029-fa85-5137-b4bc-0793ec63745f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:2860878b-737d-5747-836b-f62c840be2ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:5f499022-bf36-5237-b61b-b57c291d70d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:d198869c-6671-592c-b6cb-224fc6894853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:912f2069-a6d2-5a21-8e91-60f2922aa388", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.5 of @angular/forms. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:f3bb1ac3-5d70-51f4-b687-60061d5c67b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:dbe13189-5b3e-52a3-9fc9-c7a7b14195d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:68a1d819-bd33-5c13-98bf-044080640d44", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ], "bom-ref": "urn:uuid:7f0e8533-2a74-5e22-a56b-77defa905543", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.11-tuxcare.5 of @angular/forms." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.5" } ] }