{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:e50bc8a4-e5fc-5afb-8cc7-bd24f9ac8018",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "django",
      "purl": "pkg:pypi/django@3.2.25.post9+tuxcare",
      "type": "library",
      "bom-ref": "pkg:pypi/django@3.2.25.post9+tuxcare",
      "version": "3.2.25.post9+tuxcare",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2024-45231",
      "affects": [
        {
          "ref": "pkg:pypi/django@3.2.25.post9+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:6f42a977-a98e-5a88-add8-fd562defc43e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-45231 is fixed in version 3.2.25.post9+tuxcare of django."
      }
    },
    {
      "id": "CVE-2025-48432",
      "affects": [
        {
          "ref": "pkg:pypi/django@3.2.25.post9+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:786ad2be-5765-50aa-8507-5402004dc371",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-48432 is fixed in version 3.2.25.post9+tuxcare of django."
      }
    },
    {
      "id": "CVE-2025-57833",
      "affects": [
        {
          "ref": "pkg:pypi/django@3.2.25.post9+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:2af075c6-abd5-5d0e-89a5-0a5c313d1161",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-57833 is fixed in version 3.2.25.post9+tuxcare of django."
      }
    },
    {
      "id": "CVE-2025-64458",
      "affects": [
        {
          "ref": "pkg:pypi/django@3.2.25.post9+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:9224d162-ab64-5a91-b5fd-7118583384eb",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-64458 is fixed in version 3.2.25.post9+tuxcare of django."
      }
    },
    {
      "id": "CVE-2025-64459",
      "affects": [
        {
          "ref": "pkg:pypi/django@3.2.25.post9+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:855bc88f-0227-544d-be1a-d5d652e59491",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-64459 is fixed in version 3.2.25.post9+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-15307",
      "affects": [
        {
          "ref": "pkg:pypi/django@3.2.25.post9+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:3cb0af2e-b1cb-588f-b134-5bb4058dead2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-15307 is fixed in version 3.2.25.post9+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-15830",
      "affects": [
        {
          "ref": "pkg:pypi/django@3.2.25.post9+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:b924dca1-779c-583e-aed0-003de222003f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-15830 is fixed in version 3.2.25.post9+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-48587",
      "affects": [
        {
          "ref": "pkg:pypi/django@3.2.25.post9+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:13f29c8e-7362-531d-bc82-d64bae81a801",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-48587 affects version 3.2.25.post9+tuxcare of django, and is fixed in 3.2.25.post10+tuxcare."
      }
    },
    {
      "id": "CVE-2026-48588",
      "affects": [
        {
          "ref": "pkg:pypi/django@3.2.25.post9+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:588397c5-0eb2-571d-9128-088f77b48235",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-48588 is fixed in version 3.2.25.post9+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-53877",
      "affects": [
        {
          "ref": "pkg:pypi/django@3.2.25.post9+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:13bbf5be-e71a-5afd-9e8c-015e7cdfde7a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-53877 is fixed in version 3.2.25.post9+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-53878",
      "affects": [
        {
          "ref": "pkg:pypi/django@3.2.25.post9+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:6f4e309d-1b18-54cf-b5be-9543d8338ea3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-53878 does not affect version 3.2.25.post9+tuxcare of django. not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici...",
        "justification": "protected_at_runtime"
      }
    },
    {
      "id": "CVE-2026-6873",
      "affects": [
        {
          "ref": "pkg:pypi/django@3.2.25.post9+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:20e0a660-4a04-5139-9031-7ed7ef4e6590",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-6873 is fixed in version 3.2.25.post9+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-8404",
      "affects": [
        {
          "ref": "pkg:pypi/django@3.2.25.post9+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:37e7317c-2890-585f-b989-71ecbe612880",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-8404 is fixed in version 3.2.25.post9+tuxcare of django."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:pypi/django@3.2.25.post9+tuxcare"
    }
  ]
}