{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8fe56a15-dc3d-58d3-abf6-4bca5c2dc221", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.4", "type": "library", "name": "@angular/forms", "version": "19.2.21-tuxcare.4", "purl": "pkg:npm/%40angular/forms@19.2.21-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:c9258c60-89b7-5916-b0cd-d42d1eeb4c05", "id": "CVE-2026-27970", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27970 does not affect version 19.2.21-tuxcare.4 of @angular/forms. already_fixed \u2014 The target repository (Angular 19.2.21-tuxcare.4) already contains the fix for CVE-2026-27970. The vulnerability (XSS via unsanitized HTML attributes in ICU message translations) has been addressed by TuxCare in prior backports. The defense mechanism in packages/core/src/render3/i18n/i18n_parse.ts lines 829-843 implements the same attribute allowlist validation as the vendor patch, blocking URI..." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b7d3fb03-2760-5c12-9a11-9dc59fac95d5", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 19.2.21-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ea8b66b5-e881-56d7-a3c6-29dbe56649ed", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 19.2.21-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:fce9b466-4860-52f6-843b-ce7446180a14", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 19.2.21-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0eec8bf7-5225-5cd5-ba0f-7f3fddfd134d", "id": "CVE-2026-50170", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 19.2.21-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e165a3f8-af71-5b33-a5a4-1139f14bca4d", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 19.2.21-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5cac7d6a-06bb-564b-aa6c-7b6b7b25754c", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 19.2.21-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:066e8792-9272-5e8a-8b13-a9de9ffdd183", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 19.2.21-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:aa487757-a564-5a71-a711-b351dd95ea20", "id": "CVE-2026-50556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 19.2.21-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:67f7ec5f-7df5-5b73-9718-a4125b5cf8d0", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 19.2.21-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:81773b78-fcaf-56e4-b51f-f2f796a65a37", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 19.2.21-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1db522c2-2c95-5184-94be-3707d95ec94b", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 19.2.21-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:54fa8a1e-b073-5929-819f-e8b8ed19781c", "id": "CVE-2026-54265", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 19.2.21-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3500dfbc-9664-5b61-b5e3-6d3851c2e654", "id": "CVE-2026-54266", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 19.2.21-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:06939e4a-2064-53f4-be91-3e8e31af56aa", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 19.2.21-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4388b3fb-64be-52ea-972e-f339e8f5f371", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 19.2.21-tuxcare.4 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.4" } ] }