{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4d2ee96f-f7e4-5188-a61e-deadb974102b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/forms", "purl": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15", "type": "library", "bom-ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15", "version": "16.2.12-tuxcare.15", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:7ff41903-35b5-5c72-b041-a5e5be0f0f4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:bdab07ab-0b62-5ed8-a426-d9cf062b3c1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:500016a9-5c7c-51cc-9b3c-ac52645e6122", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:c2a0a672-cae4-56cd-8f38-9c3a0b210299", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 16.2.12-tuxcare.15 of @angular/forms, and is fixed in 16.2.12-tuxcare.16." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:177ee27b-d5e4-5e62-8fd1-8dbc0753ecee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:2c187bb1-925d-5218-a42f-172a3c95be3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:bf159e82-d4aa-53e1-a31e-f41f0d60253d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:2f7e1edf-a349-5353-9054-3ee864e56595", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:380b1652-dc0c-51b8-be63-b1552e452745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:03ebdda5-e82a-5166-9011-ce8d05bbdce8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:7ab45e01-e10f-528f-9627-3a05a8b7016b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:c01c5aa1-f748-564f-8cde-15e167b04d6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:6ce87672-cf9e-512e-b6d3-f84aa8ee6c43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:0fbd8d38-d9cd-52ae-b061-697e686307e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:2aa28165-6d44-5ced-8f46-619f6807399b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:e3c2e236-eaf6-5ee8-a3d5-a8a5d2cae10d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:c9e9dae9-6a1d-5e03-bec2-ac051c36f77b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:d0106f33-64fa-5c4b-a4c1-509084b76346", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:261ab39c-b424-5a00-b9df-138aa2968161", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:04776cd5-35b7-5b4b-9a05-d65513f0d69d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:c8577dba-f765-5a3a-8b2f-a1495fd7d09f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:38931cb0-7bc4-543b-a32c-91529f92d6ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:feae143b-3bbb-5038-b8c6-1c89cbd88e7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:ddf3f9fb-c73b-5a11-837b-6b7d72de9224", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:25e77bd9-df82-5ff0-b852-50b555000ca6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:c628415d-f709-51df-9536-2222dc6d9f10", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.15 of @angular/forms. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:1f37f95e-6cf2-5b8c-95fa-5332bb7d89a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:a32f55e2-ea38-5139-9b1a-e00a67ec35dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:011f8e69-609d-5560-a192-cf8161e424c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ], "bom-ref": "urn:uuid:37872160-13d1-5006-b1f4-1dd98c129b54", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.12-tuxcare.15 of @angular/forms." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.15" } ] }