{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:36bb48dd-2262-500d-88c6-f77fcbaea16b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "django", "purl": "pkg:pypi/django@5.0.2.post11+tuxcare", "type": "library", "bom-ref": "pkg:pypi/django@5.0.2.post11+tuxcare", "version": "5.0.2.post11+tuxcare", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-27351", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:8d2fedcc-bb18-5b6b-b2da-2289aaae7523", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-27351 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2024-38875", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:85212a61-3dab-5126-b782-ceabd98b3709", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38875 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2024-39329", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:8a8269f5-2dae-5244-a500-c4d90d7d9001", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-39329 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2024-39330", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:30e836ff-bc4c-5278-a015-a0b8af82cd25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-39330 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2024-39614", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:8ac4053b-24af-5222-ab41-e27b62b4cf61", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-39614 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2024-41989", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:04475b98-7d62-5e51-a414-e9399c18c913", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-41989 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2024-41990", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:043cef8a-86f3-56ac-9c34-8831833a556d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-41990 does not affect version 5.0.2.post11+tuxcare of django. not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo...", "justification": "code_not_present" } }, { "id": "CVE-2024-41991", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:dac4c20c-5a0b-578d-9b36-d8024846f147", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-41991 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2024-42005", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:dd35f60a-0e0d-5d33-b7dd-ccfbcc6b778d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-42005 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2024-45230", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:98487094-2748-5b07-aa1e-168318824521", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45230 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2024-45231", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:3dcd2473-0521-509a-93c1-986f00c1efb6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45231 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2024-53907", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:5c7118ff-6284-5a8e-a1b7-671a8ecc5886", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-53907 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2024-53908", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:5e9bd4f9-76e1-5fb5-8dbf-f4828334d7d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-53908 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2024-56374", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:0aa0e199-236d-5221-99bc-9d7d0da2e40f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56374 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2025-13372", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:8049cea9-6de3-5636-b1c1-186ac85762c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-13372 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2025-13473", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:e9462130-a8c8-5bbf-bfad-f5bec8baff2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-13473 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2025-14550", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:7f86b186-2570-5230-8da3-d6d33d16ea8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-14550 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2025-26699", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:615a123e-7ec2-545e-b2ab-b6a030b93408", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26699 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2025-27556", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:01926c81-3364-5382-b94c-4dce2cf4a30b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27556 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2025-48432", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:c75ff64c-470a-5f73-ae66-6f2f2b5237a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48432 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2025-57833", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:81df920e-94e9-5e71-8194-bdeebff0ebcd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-57833 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2025-64458", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:8822addf-9d77-55f7-8381-00cf55abe2ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64458 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2025-64459", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:13a81706-1ccb-5061-93bf-33cb6ba3d9b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64459 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2025-64460", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:9eb166af-eea9-50bc-9ad2-699b36cda16c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64460 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2026-1207", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:c3a53b81-0189-5b8c-b2fa-49e1d623d0bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-1207 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2026-1285", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:18acf11d-00ef-52c4-8d98-80125c6bdc49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1285 affects version 5.0.2.post11+tuxcare of django, and is fixed in 5.0.2.post12+tuxcare." } }, { "id": "CVE-2026-1287", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:6a54f641-91d4-512c-8298-1d98517e6b3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-1287 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2026-1312", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:6d13c0cf-01ff-56f4-91ea-7cd813550fd1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-1312 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2026-15307", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:6f23cb45-11c1-5a8a-8985-ee08383a3ecf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-15307 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2026-15830", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:001df9f6-6f6c-5f82-89fd-e5ca2e1fc298", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-15830 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2026-48587", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:db0b421f-bd97-5972-90f3-a1aad4ab70c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-48587 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2026-48588", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:bd40b186-7829-50aa-8d0c-66fddf1e0fdd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-48588 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2026-53877", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:f3453d91-ab3c-5f12-82cd-39bd1636dfa6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53877 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2026-53878", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:f81dc1ec-ec80-5530-86ce-e0ede7071ed6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-53878 does not affect version 5.0.2.post11+tuxcare of django. not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace.", "justification": "code_not_present" } }, { "id": "CVE-2026-6873", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:5476710d-9018-59e7-9de9-91e4219d40f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6873 is fixed in version 5.0.2.post11+tuxcare of django." } }, { "id": "CVE-2026-8404", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ], "bom-ref": "urn:uuid:4323db6f-1dd3-555e-bbd3-9206059a5231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-8404 is fixed in version 5.0.2.post11+tuxcare of django." } } ], "dependencies": [ { "ref": "pkg:pypi/django@5.0.2.post11+tuxcare" } ] }