{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:647ad6df-2e51-5883-8bf4-4bd3201cc040", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/forms@8.0.3-tuxcare.3", "type": "library", "name": "@angular/forms", "version": "8.0.3-tuxcare.3", "purl": "pkg:npm/%40angular/forms@8.0.3-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:8323d01d-053b-55fc-8925-aad9a8f06a37", "id": "CVE-2021-4231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 8.0.3-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@8.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:66b3a9db-5f3b-534b-bf28-3050c1bec647", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 8.0.3-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@8.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5f6261f7-c392-57d0-b126-ee0fc8d5dd4a", "id": "CVE-2025-66412", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 8.0.3-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@8.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:539c7c60-1355-5192-92d4-8a2f207ebc38", "id": "CVE-2026-22610", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 8.0.3-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@8.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cfd62ba6-ebea-5b68-a655-3b470cc9af42", "id": "CVE-2026-27970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 8.0.3-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@8.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c054d0af-4d93-5b62-a254-91cb0b26a102", "id": "CVE-2026-41423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41423 does not affect version 8.0.3-tuxcare.3 of @angular/forms. not_affected \u2014 The target Angular version 8.0.3 is not affected by CVE-2026-41423. The vulnerability requires WHATWG URL API (introduced in Angular 8.2.x+) to manifest the hostname override behavior. Version 8.0.3 uses Node.js legacy url.parse() which does not interpret protocol-relative URLs as having attacker-controlled hostnames." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@8.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0062f887-c1c1-52e8-a4f0-dc81130a8f5f", "id": "CVE-2026-46417", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 8.0.3-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@8.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1b7f7627-2007-58e4-8b4b-328bc619e63d", "id": "CVE-2026-50168", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 8.0.3-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@8.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c7889b14-9126-59b0-8435-4fb6726da77f", "id": "CVE-2026-50169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 8.0.3-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@8.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e10b2ed9-1119-536f-8e08-3929a98af052", "id": "CVE-2026-50170", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50170 does not affect version 8.0.3-tuxcare.3 of @angular/forms. not_affected \u2014 The target Angular v8.0.3 is NOT affected by CVE-2026-50170. The vulnerability requires the HTTP transfer cache feature (packages/common/http/src/transfer_cache.ts) and client hydration mechanisms, which were introduced in Angular v16+. This version lacks the entire affected component." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@8.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4493b292-2883-5344-b3a0-36b36ad68370", "id": "CVE-2026-50171", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 8.0.3-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@8.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6fcae522-315c-56f4-8b6b-f694bc35d239", "id": "CVE-2026-50184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 8.0.3-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@8.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1e8fadfc-5e29-5f78-ae58-bf912039ac52", "id": "CVE-2026-50555", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 8.0.3-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@8.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2e2e809b-655e-56f8-81de-a5da5ee955c1", "id": "CVE-2026-50556", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 8.0.3-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@8.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ea4e15bf-474d-5039-b598-961dc3a0d751", "id": "CVE-2026-50557", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 8.0.3-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@8.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a4e4346e-6840-576c-9edd-5ffd2403f0de", "id": "CVE-2026-52725", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 8.0.3-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@8.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:41f70411-3d56-5606-a9e5-3b98024aef79", "id": "CVE-2026-54264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54264 does not affect version 8.0.3-tuxcare.3 of @angular/forms. not_affected \u2014 The target Angular service-worker version 8.0.3-tuxcare.4 is NOT AFFECTED by CVE-2026-54264. The vulnerability requires the service worker to copy and forward request headers during cross-origin redirects. This version never copies headers: the AssetGroup path creates fresh requests from URLs only (no header preservation), and the DataGroup path delegates to the browser's spec-compliant fetch A..." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@8.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b7ccc627-f361-576f-9d10-77129e75cb28", "id": "CVE-2026-54265", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 8.0.3-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@8.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:96fa4256-9e4a-5788-8835-72209b53363f", "id": "CVE-2026-54266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54266 does not affect version 8.0.3-tuxcare.3 of @angular/forms. not_affected \u2014 Angular 8.0.3-tuxcare.4 is NOT affected by CVE-2026-54266. The vulnerable HttpTransferCache feature with its weak DJB2 hash-based cache key generation does not exist in this version. HttpTransferCache was introduced in Angular v16+, while this target is v8.0.3." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@8.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cc51567a-5302-5576-ae40-d489226b668f", "id": "CVE-2026-54267", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 8.0.3-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@8.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cd2206b7-7c4a-554a-9cf8-f03eb7cea3a9", "id": "CVE-2026-54268", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 8.0.3-tuxcare.3 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@8.0.3-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/forms@8.0.3-tuxcare.3" } ] }