{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:141f0344-9a16-54a8-9524-79beffbd35d8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/forms", "purl": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16", "type": "library", "bom-ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16", "version": "16.2.12-tuxcare.16", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:48c3f4c3-027a-5ce9-8bb3-9738440c1646", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:4adfaa58-5ee3-5525-bf7d-a042717110b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:c503da99-750e-583c-85f6-43c51b2d6d53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:02f3572f-4b94-589a-81c8-8b866f83cfac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:77d61255-28bc-589a-b50b-476f0f4100f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:d91e9d32-a94d-5918-8ed1-70c35622e024", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:c098b15b-c05b-55ef-b0eb-c72930858035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:0df0e2cc-d7da-5132-b69f-8734b19cdccf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:ce6184e6-ff77-522a-8f27-03e60f5666ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:b3c064d7-ca8f-587e-beaa-48d5887c2e83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:43d0bbbc-fb2b-561b-942b-2a8ce6a63c4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:2278751a-0930-5fb6-af4d-7dbb524c0fa8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:c3ca3d3a-e27d-5c2f-b481-fbd397597fea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:4c4969b3-1d39-57e7-ab3d-59ee268c0220", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:b54bc642-8938-5ea0-bd48-000885e1cb59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:217c5c6c-2437-502f-bf25-da1dc286f315", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:a4412945-5f25-547d-8be4-48673189dd2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:e993f6b6-75d5-58cf-b5fc-9064210133ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:7918758b-0a05-5f57-acdd-055a3f9af2fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:bf5c817c-f786-5dd7-b9d7-5bd4a734c0e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:4106d5e5-d839-54f3-92a0-5183f38237a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:352dc31b-77ef-5c43-b996-30ff2ec41837", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:30428c99-3a9f-5f5b-9e0d-52da78c1a8b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:2e0c2ca6-b804-5e0c-af53-2a733b68babe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:8377d72a-39b0-5dd4-990e-74fb08e6ad02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:dde12d8d-ff7b-5183-9d24-f14047620c0b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.12-tuxcare.16 of @angular/forms. not_affected \u2014 CVE-2026-88056 affects Angular versions 20.3.x, 21.2.x, and 22.x where a refactored URL parsing utility added String.prototype.trim() that strips Unicode whitespace, enabling SSRF bypasses. The target (Angular 16.2.12-tuxcare.12) is based on Angular 16.2.x architecture, which predates the vulnerable code pattern entirely. TuxCare created url.ts fresh on June 24, 2026 for CVE-2026-50168, modelin...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:9f421c4a-ef1f-5ccc-998d-91338cf9400c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:c8c61ce0-7da5-5243-9b62-fa73eda68b49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:5c56ab1d-1c01-579e-a53c-f2bd8a07a3fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ], "bom-ref": "urn:uuid:d0584d7a-8129-51d8-8ae9-b7ca34c59dc0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.12-tuxcare.16 of @angular/forms." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/forms@16.2.12-tuxcare.16" } ] }