{
  "@id": "urn:uuid:599978d5-d8b9-42e2-a4b9-97fc573ed966",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T15:11:52.923350+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16"
          }
        }
      ],
      "timestamp": "2026-10-18T23:36:00.206759+00:00",
      "status_notes": "Vulnerability CVE-2025-66412 is fixed in version 15.2.10-tuxcare.16 of @angular/forms.",
      "vulnerability": {
        "name": "CVE-2025-66412"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16"
          }
        }
      ],
      "timestamp": "2026-10-18T23:36:00.206759+00:00",
      "status_notes": "Vulnerability CVE-2026-101895 is fixed in version 15.2.10-tuxcare.16 of @angular/forms.",
      "vulnerability": {
        "name": "CVE-2026-101895"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16"
          }
        }
      ],
      "timestamp": "2026-10-18T23:36:00.206759+00:00",
      "status_notes": "Vulnerability CVE-2026-101896 affects version 15.2.10-tuxcare.16 of @angular/forms.",
      "vulnerability": {
        "name": "CVE-2026-101896"
      },
      "action_statement": "Vulnerability CVE-2026-101896 affects version 15.2.10-tuxcare.16 of @angular/forms."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16"
          }
        }
      ],
      "timestamp": "2026-10-18T23:36:00.206759+00:00",
      "status_notes": "Vulnerability CVE-2026-46417 is fixed in version 15.2.10-tuxcare.16 of @angular/forms.",
      "vulnerability": {
        "name": "CVE-2026-46417"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16"
          }
        }
      ],
      "timestamp": "2026-10-18T23:36:00.206759+00:00",
      "status_notes": "Vulnerability CVE-2026-50168 is fixed in version 15.2.10-tuxcare.16 of @angular/forms.",
      "vulnerability": {
        "name": "CVE-2026-50168"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16"
          }
        }
      ],
      "timestamp": "2026-10-18T23:36:00.206759+00:00",
      "status_notes": "Vulnerability CVE-2026-50169 is fixed in version 15.2.10-tuxcare.16 of @angular/forms.",
      "vulnerability": {
        "name": "CVE-2026-50169"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16"
          }
        }
      ],
      "timestamp": "2026-10-18T23:36:00.206759+00:00",
      "status_notes": "Vulnerability CVE-2026-50184 is fixed in version 15.2.10-tuxcare.16 of @angular/forms.",
      "vulnerability": {
        "name": "CVE-2026-50184"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16"
          }
        }
      ],
      "timestamp": "2026-10-18T23:36:00.206759+00:00",
      "status_notes": "Vulnerability CVE-2026-50555 is fixed in version 15.2.10-tuxcare.16 of @angular/forms.",
      "vulnerability": {
        "name": "CVE-2026-50555"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16"
          }
        }
      ],
      "timestamp": "2026-10-18T23:36:00.206759+00:00",
      "status_notes": "Vulnerability CVE-2026-50556 is fixed in version 15.2.10-tuxcare.16 of @angular/forms.",
      "vulnerability": {
        "name": "CVE-2026-50556"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16"
          }
        }
      ],
      "timestamp": "2026-10-18T23:36:00.206759+00:00",
      "status_notes": "Vulnerability CVE-2026-54264 is fixed in version 15.2.10-tuxcare.16 of @angular/forms.",
      "vulnerability": {
        "name": "CVE-2026-54264"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16"
          }
        }
      ],
      "timestamp": "2026-10-18T23:36:00.206759+00:00",
      "status_notes": "Vulnerability CVE-2026-54265 does not affect version 15.2.10-tuxcare.16 of @angular/forms. not_affected \u2014 Angular 15.2.10 is not affected by CVE-2026-54265. This version uses a desugaring approach for two-way bindings that automatically applies sanitization through the standard property binding mechanism. The vulnerability specifically affects the TwoWayProperty operation kind in the template pipeline architecture, which was introduced in Angular 16+ and does not exist in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54265"
      },
      "impact_statement": "not_affected \u2014 Angular 15.2.10 is not affected by CVE-2026-54265. This version uses a desugaring approach for two-way bindings that automatically applies sanitization through the standard property binding mechanism. The vulnerability specifically affects the TwoWayProperty operation kind in the template pipeline architecture, which was introduced in Angular 16+ and does not exist in this version."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16"
          }
        }
      ],
      "timestamp": "2026-10-18T23:36:00.206759+00:00",
      "status_notes": "Vulnerability CVE-2026-69149 is fixed in version 15.2.10-tuxcare.16 of @angular/forms.",
      "vulnerability": {
        "name": "CVE-2026-69149"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16"
          }
        }
      ],
      "timestamp": "2026-10-18T23:36:00.206759+00:00",
      "status_notes": "Vulnerability CVE-2026-88056 does not affect version 15.2.10-tuxcare.16 of @angular/forms. not_affected \u2014 Angular version 15.2.10 is NOT AFFECTED by CVE-2026-88056. The vulnerability involves String.prototype.trim() stripping Unicode whitespace in URL resolution during SSR, converting same-origin paths into cross-origin protocol-relative URLs. This vulnerable pattern was introduced in Angular v20.3.21-23 (May-June 2026) as part of SSRF hardening work. Version 15.2.10 predates this change and uses a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-88056"
      },
      "impact_statement": "not_affected \u2014 Angular version 15.2.10 is NOT AFFECTED by CVE-2026-88056. The vulnerability involves String.prototype.trim() stripping Unicode whitespace in URL resolution during SSR, converting same-origin paths into cross-origin protocol-relative URLs. This vulnerable pattern was introduced in Angular v20.3.21-23 (May-June 2026) as part of SSRF hardening work. Version 15.2.10 predates this change and uses a..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16"
          }
        }
      ],
      "timestamp": "2026-10-18T23:36:00.206759+00:00",
      "status_notes": "Vulnerability CVE-2026-88058 is fixed in version 15.2.10-tuxcare.16 of @angular/forms.",
      "vulnerability": {
        "name": "CVE-2026-88058"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16",
          "identifiers": {
            "purl": "pkg:npm/%40angular/forms@15.2.10-tuxcare.16"
          }
        }
      ],
      "timestamp": "2026-10-18T23:36:00.206759+00:00",
      "status_notes": "Vulnerability CVE-2026-88060 is fixed in version 15.2.10-tuxcare.16 of @angular/forms.",
      "vulnerability": {
        "name": "CVE-2026-88060"
      }
    }
  ]
}