{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3df82ece-dcc4-5e65-b074-68a1a2567a97", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/forms", "purl": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15", "type": "library", "bom-ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15", "version": "6.1.10-tuxcare.15", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:f6139976-7329-5ebe-a0c3-58af6b30a5ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 6.1.10-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:658662c9-2bee-58cd-9a4c-bde1623d5008", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 6.1.10-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:10a62cca-df97-5125-be5a-850820bca376", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 6.1.10-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:87f2586c-a2a5-5a57-aacc-0dea3b69b8e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101895 is fixed in version 6.1.10-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-101896", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:6128e7ee-9c70-547f-8ce9-2489e13caaaf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101896 affects version 6.1.10-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:69cc2af2-c0c9-5a23-8d8f-2a8b2b331425", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 6.1.10-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:50d56c3d-46c2-5193-9feb-aa2f834bba64", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 6.1.10-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:ca51f76a-2876-582b-9088-04b7d92cf49c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 6.1.10-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:eee2ea2f-9592-502b-893c-525b87cdafe8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 6.1.10-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:b88988cf-44b0-5b8f-bc1b-a353d4790748", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 6.1.10-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:528e4724-3590-57eb-abb1-8a5b5955639d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 6.1.10-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:39dc4fb5-30f3-58e3-bd06-3680a9ba7b80", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 6.1.10-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:b7abe02f-bf1e-5b01-bc1c-974ca636e29e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 6.1.10-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:df9c8e89-06c8-5222-8f92-f2f9600ff185", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 6.1.10-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:1eba502b-1cb2-53f2-aa6c-b8ecfa43912b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 6.1.10-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:95d4646e-54ba-537d-a9db-47913d6b8950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 6.1.10-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:a4a4cf11-4c70-54f2-b0c9-328694519cd7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 6.1.10-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:8f358ace-91d5-53d0-aff2-0db2a09112a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 6.1.10-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:9783a3a8-f80d-5203-9f09-d73da28a0ab6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 6.1.10-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:1197e509-807f-5a7f-a21c-47c906a74f9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 6.1.10-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:19d3c288-dc5f-5606-82cc-c33a59b04d87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 6.1.10-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:a55680db-22e4-5c32-bd9a-dedf56d05c21", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 6.1.10-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:bab0ecf2-a2e8-5559-9774-e46db8b7b42d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 6.1.10-tuxcare.15 of @angular/forms. not_affected \u2014 Angular 6.1.10 is NOT AFFECTED by CVE-2026-68945. The vulnerable HttpTransferCache feature does not exist in this version \u2014 it was introduced in Angular 16.0.0 (April 2023), more than 5 years after Angular 6.1.10 (2018). The vulnerable file `packages/common/http/src/transfer_cache.ts` and all related APIs (`provideClientHydration`, `withNoHttpTransferCache`, `sortAndConcatParams`) are completel...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:efe4da2b-e7de-53ff-b38b-99fad958e81b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 6.1.10-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:e0097dcb-27f2-59ff-a62f-7204f9631d2d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 6.1.10-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:68172360-af4e-5b58-a5f6-96910e130e7d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 6.1.10-tuxcare.15 of @angular/forms. not_affected \u2014 Angular version 6.1.10 is not affected by CVE-2026-88056. The vulnerable code pattern (url.ts with parseUrl using String.prototype.trim() and relativeUrlsTransformerInterceptorFn interceptor) does not exist in this version. These components were introduced in later Angular versions (post-6.1.10) and subsequently fixed in August 2026. Version 6.1.10 predates the vulnerable SSR URL resolution arc...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:da1bb4a2-f0d6-580d-95c0-07a8e28a8afc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 6.1.10-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:1b8c1638-3ff7-50c9-a5da-088e6c07b372", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 6.1.10-tuxcare.15 of @angular/forms." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:52c86e30-b4c1-5fba-b449-2358eb89c023", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 6.1.10-tuxcare.15 of @angular/forms. not_affected \u2014 Angular 6.1.10 is not affected by CVE-2026-88059. The vulnerable HttpTransferCache feature, withRequestsMadeViaParent() delegation API, and modern hydration system (provideClientHydration()) do not exist in this version. These components were introduced in Angular 16+ (circa 2023), while the target version is from Angular 6 (2018). The vulnerability requires automatic HTTP response caching duri...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ], "bom-ref": "urn:uuid:2ec05ee1-faed-5fda-a6cd-9d4a404820e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 6.1.10-tuxcare.15 of @angular/forms." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.15" } ] }