{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bb2d010b-6021-5f0c-95c1-c150beea2cb3", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/forms", "purl": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10", "type": "library", "bom-ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10", "version": "17.3.12-tuxcare.10", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:8a5d0293-05c6-5043-8f11-5f6876042b7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.3.12-tuxcare.10 of @angular/forms." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:dd92e24d-b648-5019-8f69-5a511523c369", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.3.12-tuxcare.10 of @angular/forms." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:263b08cc-2dce-53a4-88e5-48363356f02b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 17.3.12-tuxcare.10 of @angular/forms." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:55280ee4-02da-50d1-945a-9ec38e86ad77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.3.12-tuxcare.10 of @angular/forms." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:d7e67d7b-6df9-5fab-9243-196ae060b7b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.3.12-tuxcare.10 of @angular/forms." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:b06a2106-10a2-5b2c-8f9c-1ba5fbe77c12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.3.12-tuxcare.10 of @angular/forms." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:96baf8b1-e82f-560d-96c6-2fff95671ed9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 17.3.12-tuxcare.10 of @angular/forms, and is fixed in 17.3.12-tuxcare.12." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:8bbd703a-374e-57b9-ab43-a0f84f7b070c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 17.3.12-tuxcare.10 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:53397a5a-598a-59d9-bcef-199398b11648", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 17.3.12-tuxcare.10 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:f168389e-e5f2-55ae-b194-a53f479f25b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 17.3.12-tuxcare.10 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:b2b410c0-64d8-5820-9e73-37c11f8d1c9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 17.3.12-tuxcare.10 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:5339f022-3b83-585e-b505-92e92889fbe3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 17.3.12-tuxcare.10 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:848e4085-36db-5551-a741-a99cec360db8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 17.3.12-tuxcare.10 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:ae5f3e32-396e-5265-9169-b54264bf0f4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 17.3.12-tuxcare.10 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:30e2b044-b957-590e-9323-1eb5fa3d8704", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 17.3.12-tuxcare.10 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:39974a07-c237-541c-b036-c8ed0a1088fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 17.3.12-tuxcare.10 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:ac26ec51-4801-5e82-ab77-869ca8f0b1e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 17.3.12-tuxcare.10 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:2886cb49-d5ba-5cc4-b9e0-167697ca958a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 17.3.12-tuxcare.10 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:244872ae-f18e-5c81-b1f8-2dbec34761f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 17.3.12-tuxcare.10 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:5650f9b9-5191-58bb-9c88-438c679fd8ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 17.3.12-tuxcare.10 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:0484f094-37ea-55b2-828d-5ea790337068", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 17.3.12-tuxcare.10 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:c67818d8-9ea9-5881-b3b3-c322e970646e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 17.3.12-tuxcare.10 of @angular/forms, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:09343aa8-231d-5a40-bc69-e622b4c67c51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 17.3.12-tuxcare.10 of @angular/forms, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:d6935e95-f46a-5b58-b357-da6a1bf2fba8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 17.3.12-tuxcare.10 of @angular/forms, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:b31fb9c3-034f-5a84-8840-de8b3f12a89b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.10 of @angular/forms. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:f00895ec-f9cd-5092-9f41-faff0f30c4ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.3.12-tuxcare.10 of @angular/forms." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:760c4cdc-0a33-56e2-991f-64297d4df26d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.3.12-tuxcare.10 of @angular/forms." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ], "bom-ref": "urn:uuid:7722f381-2714-5681-be0f-63e2298d7e40", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.3.12-tuxcare.10 of @angular/forms." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.10" } ] }