{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c5e84a33-177b-5aa5-b65e-08cd0448efff", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/forms", "purl": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4", "version": "16.2.11-tuxcare.4", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:ee9240f3-1862-5943-8a9d-d787d3180492", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:2ab8b036-09fd-5f35-91e3-826b88f0d7ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:25ade1ae-8aa7-59c2-a743-fb23d07a9ab6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2026-101895", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:7f92f0be-a8a1-5711-a38c-3df38d54ea1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101895 affects version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:9d452056-12dc-5cb8-a189-69b8b0d45d27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:dcd46b44-f777-5180-9c70-4057a0914c55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2026-41423", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:ae0eabd1-8db4-5227-8b80-4f0d1a467cce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:2b3214f6-1892-52b3-85f1-44c80fb040ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:0094ce20-1b48-50da-a0b5-d881a5d25cae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:22800b72-5d25-5ffb-a43b-c20523c51ac6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:3c9baa95-b6c7-5635-9cdb-387e5ce5c591", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:1ba154a0-ed1d-52e0-9e7d-a0cd7ce75c8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:ad30d0eb-5b8e-5e3f-90ab-d43b8d8c3fbd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:ecf3bf57-6f3d-5548-ba4c-e1b7e64c9d55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:e206f173-d0b5-5dc3-80cf-9eac4c8be42d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50556 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:82ad8c1c-7e5b-5bb9-93e3-72b94e3efaf3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:338762a1-d657-5ef0-82e2-4f6d834d4f57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:a5486108-d9fb-5409-8c29-70a28b5cb5d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:1ca2aa25-ee1c-5b3f-9a9d-22535f55e6d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54265 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:f84be77d-172a-5744-944a-58f0db71f9ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:1bfc955f-fef4-5bf8-9cc4-ff4fd20104cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:f9d78888-b186-5052-8431-57e6e3dcfcb5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:33974e90-14d5-5f55-8ddd-84c9b8fc2790", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68945 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:0b21bcac-4f72-568b-994e-6635431ce969", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69149 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:a5820dfd-2c67-577b-a816-e113427facc6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69151 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:1a8adea4-d152-54a5-9cb5-ea07b14fe314", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 16.2.11-tuxcare.4 of @angular/forms. not_affected \u2014 Angular 16.2.11-tuxcare.2 is NOT affected by CVE-2026-88056. The vulnerability requires WHATWG URL validation combined with String.prototype.trim() on URLs during SSR, creating a discrepancy that enables SSRF. While the target uses WHATWG URL parsing (backported in commit c03fbfd7cc for CVE-2026-50168), it does NOT call String.prototype.trim() on URLs. The attack chain is broken at the trim() s...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:2eb5b377-97ff-5123-b68c-48efc6fc5a59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88057 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2026-88058", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:88dcea03-aaeb-5d42-be61-8001a62f754c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88058 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:d1e1db2c-ecc2-51b6-8673-3fc17d52dd64", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88059 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ], "bom-ref": "urn:uuid:55efba4d-5324-529e-b946-b5712d8d551a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-88060 is fixed in version 16.2.11-tuxcare.4 of @angular/forms." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/forms@16.2.11-tuxcare.4" } ] }