{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b32cc9c5-4a54-5f40-b24e-a551fda3f843", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40angular/forms@17.1.0-tuxcare.2", "type": "library", "name": "@angular/forms", "version": "17.1.0-tuxcare.2", "purl": "pkg:npm/%40angular/forms@17.1.0-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:e4a6d3b0-cc75-5412-b4cd-8494bc410e26", "id": "CVE-2017-16009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-16009 is fixed in version 17.1.0-tuxcare.2 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e8380336-e46d-5a2b-b523-e6a78951c7c4", "id": "CVE-2025-59052", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59052 is fixed in version 17.1.0-tuxcare.2 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:84ad3b9e-a664-5176-bd14-c4ceaa5dfee0", "id": "CVE-2025-66035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66035 is fixed in version 17.1.0-tuxcare.2 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:54c24b90-9b1a-583a-9bee-e7ae730e6e39", "id": "CVE-2025-66412", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66412 affects version 17.1.0-tuxcare.2 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:577aad7e-d643-5931-b042-13fb8f0c5aea", "id": "CVE-2026-22610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22610 is fixed in version 17.1.0-tuxcare.2 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:62c19e37-0b18-5472-936f-31f2f0002280", "id": "CVE-2026-27970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-27970 is fixed in version 17.1.0-tuxcare.2 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7aff80e8-30e9-5691-936f-159a59810fad", "id": "CVE-2026-32635", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32635 is fixed in version 17.1.0-tuxcare.2 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7f449028-de3d-5305-93b8-d60eca29f266", "id": "CVE-2026-41423", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41423 is fixed in version 17.1.0-tuxcare.2 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0e317652-99b7-5b3e-9532-a05c7284e447", "id": "CVE-2026-46417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46417 is fixed in version 17.1.0-tuxcare.2 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:792d5e8d-930a-5913-9887-c1d641bbcc8d", "id": "CVE-2026-50168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50168 is fixed in version 17.1.0-tuxcare.2 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:80804df4-2b16-586b-89a8-e6445545dd8c", "id": "CVE-2026-50169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50169 is fixed in version 17.1.0-tuxcare.2 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:bb492dd8-c54d-525f-baa1-a496839aa35a", "id": "CVE-2026-50170", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50170 is fixed in version 17.1.0-tuxcare.2 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2e0eb690-2d3e-5903-9601-354ce9350406", "id": "CVE-2026-50171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50171 is fixed in version 17.1.0-tuxcare.2 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:900f06a2-482b-518a-a0ef-212d3826e0c4", "id": "CVE-2026-50184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50184 is fixed in version 17.1.0-tuxcare.2 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e1d3ddb2-b502-55a0-83b6-94cd7a56c582", "id": "CVE-2026-50555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50555 is fixed in version 17.1.0-tuxcare.2 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d560d603-140c-55e3-bc67-be2a6220614d", "id": "CVE-2026-50556", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-50556 does not affect version 17.1.0-tuxcare.2 of @angular/forms. not_affected \u2014 The Angular repository source code is NOT affected by CVE-2026-50556. The vulnerability exists in the external domino dependency (lib/NodeUtils.js), not in Angular's source code. TuxCare's own patch documentation explicitly states: 'DEPENDENCY fix, NOT Angular source' and 'domino is external/runtime (not bundled)'. Angular's code only imports and calls domino's API but does not contain domino's..." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e8310e91-1b1d-57c0-b2fd-ebd8464b7606", "id": "CVE-2026-50557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50557 is fixed in version 17.1.0-tuxcare.2 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:aeecbbba-29e4-508e-93b2-5ba9f57eed6f", "id": "CVE-2026-52725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-52725 is fixed in version 17.1.0-tuxcare.2 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7cf7fdf6-428b-5bea-a20a-7036d2fead5a", "id": "CVE-2026-54264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54264 is fixed in version 17.1.0-tuxcare.2 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f7917fe1-9066-5fb4-9008-489fa111b284", "id": "CVE-2026-54265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54265 does not affect version 17.1.0-tuxcare.2 of @angular/forms. not_affected \u2014 Angular v17.1.0 does not have the TwoWayProperty IR operation that is the subject of CVE-2026-54265. Two-way bindings are desugared into separate property and event bindings before template pipeline processing, with the property half using the same parsePropertyBinding() code path as one-way property bindings, which are properly sanitized." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:813f3229-d411-5cae-ba29-b5cf0c7be8b8", "id": "CVE-2026-54266", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54266 is fixed in version 17.1.0-tuxcare.2 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c697ece7-633e-58d6-afec-7e1043816a8e", "id": "CVE-2026-54267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54267 is fixed in version 17.1.0-tuxcare.2 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@17.1.0-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3305c486-c6a1-59f8-9a2d-67b4fc7e4401", "id": "CVE-2026-54268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54268 is fixed in version 17.1.0-tuxcare.2 of @angular/forms." }, "affects": [ { "ref": "pkg:npm/%40angular/forms@17.1.0-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40angular/forms@17.1.0-tuxcare.2" } ] }