{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3a92fa5c-1859-5273-a7f7-c8c386e483ff", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@angular/forms", "purl": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5", "version": "6.1.10-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-4231", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:63fe2b88-d1b4-5ea6-bc1e-7d5dc757e54c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-4231 is fixed in version 6.1.10-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2025-66035", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:16370b51-af9f-5c2f-bf1b-0de910942f10", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66035 affects version 6.1.10-tuxcare.5 of @angular/forms, and is fixed in 6.1.10-tuxcare.10." } }, { "id": "CVE-2025-66412", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:921ae3cf-03b3-559e-acb0-48c7ee8e0b77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66412 is fixed in version 6.1.10-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-22610", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:f12282f9-044c-55fb-82eb-170357ba46ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 6.1.10-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-27970", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:7b1029cb-bfdc-5281-a28b-c62b75a6119d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-27970 affects version 6.1.10-tuxcare.5 of @angular/forms, and is fixed in 6.1.10-tuxcare.6." } }, { "id": "CVE-2026-46417", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:df4d222f-40cd-51df-934b-1ff8f3cd37c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46417 affects version 6.1.10-tuxcare.5 of @angular/forms, and is fixed in 6.1.10-tuxcare.8." } }, { "id": "CVE-2026-50168", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:fb48631b-df33-5182-ae59-29e3af875858", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50168 affects version 6.1.10-tuxcare.5 of @angular/forms, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50169", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:ae096620-b945-599a-b413-cf8ee45125e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50169 affects version 6.1.10-tuxcare.5 of @angular/forms, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50170", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:d0e74421-f3b0-5e2b-8a66-8684ec2268aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50170 affects version 6.1.10-tuxcare.5 of @angular/forms, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50171", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:ed4221fa-888b-5979-bcc4-753b2a5b7f28", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50171 affects version 6.1.10-tuxcare.5 of @angular/forms, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50184", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:5c99df0c-f00d-5d5b-a786-2b29490aaa5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50184 affects version 6.1.10-tuxcare.5 of @angular/forms, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50555", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:5b4ca415-c608-5523-a4b6-afd92893e6d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50555 affects version 6.1.10-tuxcare.5 of @angular/forms, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50556", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:46e26aba-608c-5d79-9181-66a9ffba0f51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50556 affects version 6.1.10-tuxcare.5 of @angular/forms, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-50557", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:bd0b9c35-8045-5a2f-af1a-3b01df9ec87f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50557 affects version 6.1.10-tuxcare.5 of @angular/forms, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-52725", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:474d3da0-2d57-50c8-b566-972ebba138b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52725 affects version 6.1.10-tuxcare.5 of @angular/forms, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-54264", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:74fd3172-5ec3-5838-8ad5-c26d77ba545d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54264 affects version 6.1.10-tuxcare.5 of @angular/forms, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-54265", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:df56aa4a-69d4-53d6-a329-87f3504252ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54265 affects version 6.1.10-tuxcare.5 of @angular/forms, and is fixed in 6.1.10-tuxcare.8." } }, { "id": "CVE-2026-54266", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:ee928c03-6327-591d-865b-907c0e8951cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54266 affects version 6.1.10-tuxcare.5 of @angular/forms, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-54267", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:a40f7494-b1e8-5cb2-ae0b-f1da1159e900", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54267 affects version 6.1.10-tuxcare.5 of @angular/forms, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-54268", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:b0956609-276e-5654-829a-eb0894cd97ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54268 affects version 6.1.10-tuxcare.5 of @angular/forms, and is fixed in 6.1.10-tuxcare.9." } }, { "id": "CVE-2026-68945", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:d460ed1d-712e-5b6a-bf8a-c84e56d6820a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-68945 does not affect version 6.1.10-tuxcare.5 of @angular/forms. not_affected \u2014 Angular 6.1.10 is NOT AFFECTED by CVE-2026-68945. The vulnerable HttpTransferCache feature does not exist in this version \u2014 it was introduced in Angular 16.0.0 (April 2023), more than 5 years after Angular 6.1.10 (2018). The vulnerable file `packages/common/http/src/transfer_cache.ts` and all related APIs (`provideClientHydration`, `withNoHttpTransferCache`, `sortAndConcatParams`) are completel...", "justification": "code_not_present" } }, { "id": "CVE-2026-69149", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:2d47efbb-0092-5742-ab45-2d54cac26f58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69149 affects version 6.1.10-tuxcare.5 of @angular/forms, and is fixed in 6.1.10-tuxcare.11." } }, { "id": "CVE-2026-69151", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:111b7064-f51e-572d-b660-c357d1f33847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69151 affects version 6.1.10-tuxcare.5 of @angular/forms, and is fixed in 6.1.10-tuxcare.11." } }, { "id": "CVE-2026-88056", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:9456dc7f-41b5-5e13-9597-c5c5a8d56573", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88056 does not affect version 6.1.10-tuxcare.5 of @angular/forms. not_affected \u2014 Angular version 6.1.10 is not affected by CVE-2026-88056. The vulnerable code pattern (url.ts with parseUrl using String.prototype.trim() and relativeUrlsTransformerInterceptorFn interceptor) does not exist in this version. These components were introduced in later Angular versions (post-6.1.10) and subsequently fixed in August 2026. Version 6.1.10 predates the vulnerable SSR URL resolution arc...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-88057", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:0515392c-8b2b-54c2-a1e0-f6f565659860", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88057 affects version 6.1.10-tuxcare.5 of @angular/forms." } }, { "id": "CVE-2026-88059", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:18bac10e-e564-5c89-bbd5-5a2602ecbea4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-88059 does not affect version 6.1.10-tuxcare.5 of @angular/forms. not_affected \u2014 Angular 6.1.10 is not affected by CVE-2026-88059. The vulnerable HttpTransferCache feature, withRequestsMadeViaParent() delegation API, and modern hydration system (provideClientHydration()) do not exist in this version. These components were introduced in Angular 16+ (circa 2023), while the target version is from Angular 6 (2018). The vulnerability requires automatic HTTP response caching duri...", "justification": "code_not_present" } }, { "id": "CVE-2026-88060", "affects": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ], "bom-ref": "urn:uuid:d56a2a7f-675a-58cf-9c0f-98065d5f1592", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-88060 affects version 6.1.10-tuxcare.5 of @angular/forms." } } ], "dependencies": [ { "ref": "pkg:npm/%40angular/forms@6.1.10-tuxcare.5" } ] }