{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bf939dcc-8a16-567e-af7e-316128395fd9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/forms", "purl": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2", "version": "17.3.12-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-59052", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:2e82cede-01cc-5cc9-8144-dc1fc52b3c99", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59052 affects version 17.3.12-tuxcare.2 of @angular/forms, and is fixed in 17.3.12-tuxcare.3." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:85418446-0966-517a-b913-6662756e262f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 17.3.12-tuxcare.2 of @angular/forms, and is fixed in 17.3.12-tuxcare.3." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:1d0770a7-2441-5447-9baf-42a8564acb1a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 17.3.12-tuxcare.2 of @angular/forms, and is fixed in 17.3.12-tuxcare.5." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:34020e17-2b1f-51e5-bc6b-0aca5197dd9c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22610 affects version 17.3.12-tuxcare.2 of @angular/forms, and is fixed in 17.3.12-tuxcare.5." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:068d4861-e8a4-57e2-a019-5e495e92bfb1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 17.3.12-tuxcare.2 of @angular/forms, and is fixed in 17.3.12-tuxcare.9." } }, { "id": "CVE-2026-32635", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:87978e46-29b6-557f-a5ac-b02c942a1f42", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-32635 affects version 17.3.12-tuxcare.2 of @angular/forms, and is fixed in 17.3.12-tuxcare.7." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:7de74173-4a43-5264-a514-e613ae26e901", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 17.3.12-tuxcare.2 of @angular/forms, and is fixed in 17.3.12-tuxcare.12." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:36230f62-4b93-51ac-bd94-9689072d0385", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 17.3.12-tuxcare.2 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:b6ef84a4-f34f-5c14-90fa-98518c987641", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 17.3.12-tuxcare.2 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:d6aced4f-2262-5436-a467-75d9d7024ca2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 17.3.12-tuxcare.2 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:8ee6305e-8e13-5907-a828-7f611d5f83f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 17.3.12-tuxcare.2 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:ce3339e0-2d89-5499-bec1-a6cb9361ca8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 17.3.12-tuxcare.2 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:4fe38cff-4e31-57d1-a4c9-e5b2d7266e76", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 17.3.12-tuxcare.2 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:2825e2b9-4ba0-5b6c-a667-d74bb74b3158", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 17.3.12-tuxcare.2 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:f649e376-707e-550b-8a93-aa08c24c1119", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 17.3.12-tuxcare.2 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:06f2c28c-3654-52a9-bfb0-962025b4c41b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 17.3.12-tuxcare.2 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:5245df2f-f455-5101-91bf-3f3ae496d203", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 17.3.12-tuxcare.2 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:92628db0-d774-5144-99f6-02d72061efc4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 17.3.12-tuxcare.2 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:bfe59703-0166-5753-947c-01a64f1a7d04", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 17.3.12-tuxcare.2 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:84f93466-0d85-5062-b992-94deb57e40fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 17.3.12-tuxcare.2 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:857eb4df-f88f-5584-9f83-b9be257f2a47", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 17.3.12-tuxcare.2 of @angular/forms, and is fixed in 17.3.12-tuxcare.13." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:8cce18b5-92f6-53c7-ad8e-f71753678a49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68945 affects version 17.3.12-tuxcare.2 of @angular/forms, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:dcf4151b-f4f1-58b9-bcf5-c665ab5f756d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 17.3.12-tuxcare.2 of @angular/forms, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:ca450213-1d8a-556c-bf62-eb897a780de9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 17.3.12-tuxcare.2 of @angular/forms, and is fixed in 17.3.12-tuxcare.14." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:e72ef634-6564-5dc1-b9fc-c6d7e6191055", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 17.3.12-tuxcare.2 of @angular/forms. not_affected \u2014 Version 17.3.12 is not affected by CVE-2026-88056. The vulnerability involves String.prototype.trim() being applied during URL resolution in Angular's platform-server, converting validated same-origin URLs with Unicode whitespace into cross-origin protocol-relative URLs, leading to SSRF. This vulnerable code pattern was introduced in newer Angular versions (v20+) and does not exist in version 1...", "justification": "code_not_present" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:6582b52a-460d-5d67-82ba-b984ad4d1ee4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 17.3.12-tuxcare.2 of @angular/forms." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:0d90ca16-ee97-501d-88f6-1283e7717fe6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88059 affects version 17.3.12-tuxcare.2 of @angular/forms." } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ], "bom-ref": "urn:uuid:36b92fde-3158-58a6-b5b6-02edc2bc8fd3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 17.3.12-tuxcare.2 of @angular/forms." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/forms@17.3.12-tuxcare.2" } ] }