{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:147ecb31-c736-5eaa-bbbb-284a8c47c43d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/forms",
      "purl": "pkg:npm/%40angular/forms@19.2.21-tuxcare.6",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.6",
      "version": "19.2.21-tuxcare.6",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-27970",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:008b8344-b025-5737-8d10-555f55d2799d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-27970 does not affect version 19.2.21-tuxcare.6 of @angular/forms. already_fixed \u2014 The target repository (Angular 19.2.21-tuxcare.4) already contains the fix for CVE-2026-27970. The vulnerability (XSS via unsanitized HTML attributes in ICU message translations) has been addressed by TuxCare in prior backports. The defense mechanism in packages/core/src/render3/i18n/i18n_parse.ts lines 829-843 implements the same attribute allowlist validation as the vendor patch, blocking URI...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-46417",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:f80e3dd5-fea7-5451-97d2-11c8c8720bcc",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-46417 is fixed in version 19.2.21-tuxcare.6 of @angular/forms."
      }
    },
    {
      "id": "CVE-2026-50168",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:e77d688b-ee64-5df4-abde-52d1a31671e0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50168 is fixed in version 19.2.21-tuxcare.6 of @angular/forms."
      }
    },
    {
      "id": "CVE-2026-50169",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:f542f0a7-0580-5d9b-9990-1927ba97dd27",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50169 is fixed in version 19.2.21-tuxcare.6 of @angular/forms."
      }
    },
    {
      "id": "CVE-2026-50170",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:593778cd-3d03-53f1-9fd8-e3d1ceabe8fe",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50170 is fixed in version 19.2.21-tuxcare.6 of @angular/forms."
      }
    },
    {
      "id": "CVE-2026-50171",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:eeb75830-c629-5118-80a1-bec615c2e375",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50171 is fixed in version 19.2.21-tuxcare.6 of @angular/forms."
      }
    },
    {
      "id": "CVE-2026-50184",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:3a796ce8-9b1a-53df-b619-9415653e27b3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50184 is fixed in version 19.2.21-tuxcare.6 of @angular/forms."
      }
    },
    {
      "id": "CVE-2026-50555",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:81f60e97-15d4-5f70-802c-f5d3db8178ab",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50555 is fixed in version 19.2.21-tuxcare.6 of @angular/forms."
      }
    },
    {
      "id": "CVE-2026-50556",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:e7aa4952-494d-5c30-a46e-95779157d223",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50556 is fixed in version 19.2.21-tuxcare.6 of @angular/forms."
      }
    },
    {
      "id": "CVE-2026-50557",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:4b01af1b-1e8b-51e1-b196-12b92c96845f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50557 is fixed in version 19.2.21-tuxcare.6 of @angular/forms."
      }
    },
    {
      "id": "CVE-2026-52725",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:2053cc2f-8cac-5133-ba88-567fde5fdffd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-52725 is fixed in version 19.2.21-tuxcare.6 of @angular/forms."
      }
    },
    {
      "id": "CVE-2026-54264",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:4f392fcb-53d4-5942-a2dd-4f6fd04ea9bd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54264 is fixed in version 19.2.21-tuxcare.6 of @angular/forms."
      }
    },
    {
      "id": "CVE-2026-54265",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:d99a6830-123d-5488-b20e-6cb329975a31",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54265 is fixed in version 19.2.21-tuxcare.6 of @angular/forms."
      }
    },
    {
      "id": "CVE-2026-54266",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:826ac058-acde-515d-9e11-8ab14c6840ca",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54266 is fixed in version 19.2.21-tuxcare.6 of @angular/forms."
      }
    },
    {
      "id": "CVE-2026-54267",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:57eb3b18-b4a1-59ab-8f04-66f1c79a556b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54267 is fixed in version 19.2.21-tuxcare.6 of @angular/forms."
      }
    },
    {
      "id": "CVE-2026-54268",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:e6d7e761-13fa-53b4-9c9d-a73c235921c1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54268 is fixed in version 19.2.21-tuxcare.6 of @angular/forms."
      }
    },
    {
      "id": "CVE-2026-68945",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:2bee5911-3bea-53f0-813b-73b192be9b69",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-68945 is fixed in version 19.2.21-tuxcare.6 of @angular/forms."
      }
    },
    {
      "id": "CVE-2026-69149",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:4fe9cf7c-c488-5de9-8518-1dd96f16605d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-69149 is fixed in version 19.2.21-tuxcare.6 of @angular/forms."
      }
    },
    {
      "id": "CVE-2026-69151",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:f25af9fc-b9fc-5373-9b5e-cda44138e740",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-69151 is fixed in version 19.2.21-tuxcare.6 of @angular/forms."
      }
    },
    {
      "id": "CVE-2026-88056",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:96d55647-1da1-5532-a755-743a61f1f573",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88056 does not affect version 19.2.21-tuxcare.6 of @angular/forms. not_affected \u2014 CVE-2026-88056 does not affect this Angular v19.2.21-tuxcare.5 target. The CVE describes a vulnerability where `String.prototype.trim()` strips Unicode whitespace (U+00A0, U+FEFF) from URLs during SSR, converting same-origin relative paths into cross-origin protocol-relative URLs that leak credentials. The v19.2.x branch uses a simpler URL resolution implementation created by TuxCare (commit 81...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-88057",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:51a0103a-efd6-57d5-af7d-4e3c7063c709",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88057 affects version 19.2.21-tuxcare.6 of @angular/forms."
      }
    },
    {
      "id": "CVE-2026-88059",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:950670f4-25a9-5397-a76f-29406580194b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88059 affects version 19.2.21-tuxcare.6 of @angular/forms."
      }
    },
    {
      "id": "CVE-2026-88060",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:f8ace8cc-c05c-5fc7-9b6a-e682634b23e1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-88060 affects version 19.2.21-tuxcare.6 of @angular/forms."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/forms@19.2.21-tuxcare.6"
    }
  ]
}