{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:411ee27d-aa41-5985-b664-729dba9fc706", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "django", "purl": "pkg:pypi/django@5.0.2.post14+tuxcare", "type": "library", "bom-ref": "pkg:pypi/django@5.0.2.post14+tuxcare", "version": "5.0.2.post14+tuxcare", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-27351", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:77092f6a-e56a-55f9-9d61-ed8e7aad5978", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-27351 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2024-38875", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:8e42b37c-6e5a-5820-8c4c-b0298cf39cc1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38875 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2024-39329", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:1c94cc3a-3949-5244-b1b3-857ea419525d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-39329 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2024-39330", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:9bf0b80b-445b-5983-926e-762b75e6f693", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-39330 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2024-39614", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:120a45bf-e4ee-58b3-a8da-ea0ccaf28264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-39614 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2024-41989", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:d3d9bc15-fe3a-5c3f-8d4e-3bc660b64609", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-41989 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2024-41990", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:ba20f509-a815-53e4-80f1-05fc08b05e0b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-41990 does not affect version 5.0.2.post14+tuxcare of django. not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo...", "justification": "code_not_present" } }, { "id": "CVE-2024-41991", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:3594d579-2366-53c4-b5fc-9fd7e0cb5775", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-41991 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2024-42005", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:e1503fa6-692c-5a68-93fc-5c2800e7422f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-42005 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2024-45230", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:d4b3a577-acc9-50e0-844e-c5d88552ea19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45230 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2024-45231", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:f5b458b8-6221-557e-91ec-a7a8d90eb407", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45231 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2024-53907", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:3cfaa244-afc5-5c72-9a2a-4f18d0537f8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-53907 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2024-53908", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:0fec00a7-4876-513d-ae22-bdac3a04aa9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-53908 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2024-56374", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:c914968a-b30e-56b8-8db9-13e45b182d6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56374 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2025-13372", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:b4ff0293-2f7f-5c2e-9538-668c7340fc43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-13372 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2025-13473", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:4a79569a-21f0-5436-a8d9-b1f2d68f28fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-13473 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2025-14550", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:37f09284-1847-5fae-8550-c4267eefc53a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-14550 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2025-26699", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:3cd86650-b276-5027-b382-3879e4a024a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26699 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2025-27556", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:70c119a3-867a-5331-b242-9cec1ff4bd43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27556 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2025-48432", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:62260d92-ea7a-5fc9-9bf8-84e9fd6d42ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48432 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2025-57833", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:087f44d0-86d4-540b-add4-354e36dbc7bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-57833 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2025-64458", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:047890a6-6b11-5521-abb3-a3e6c0686815", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64458 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2025-64459", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:ce697aa0-4d19-5ef9-bdae-b172b4cb33a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64459 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2025-64460", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:32eda8c7-540e-58d2-96b2-5f076115274e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64460 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2026-1207", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:1fe3e28e-7a8e-5a1f-be2a-088f13e9eb15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-1207 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2026-1285", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:16bf4c33-782a-57f5-8ee0-70460338a4eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-1285 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2026-1287", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:c33be608-62f2-525e-b1aa-647008054cc4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-1287 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2026-1312", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:c94633d0-f504-5c9c-a61f-f6774070f9b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-1312 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2026-15307", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:5254ebbc-1e09-5bb2-8ad7-fe7226f45790", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-15307 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2026-15830", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:90ec478b-703e-58eb-8c22-551d1cf459c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-15830 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2026-48587", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:608fc623-63a1-56db-9625-2a6f04ee14bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-48587 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2026-48588", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:4010e494-90a2-505c-924c-74fb74987415", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-48588 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2026-53877", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:c13cd727-5943-52e1-ad45-32fbc7761742", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53877 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2026-53878", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:c46a9fa6-1333-56e6-ac01-77b1883febf8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-53878 does not affect version 5.0.2.post14+tuxcare of django. not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace.", "justification": "code_not_present" } }, { "id": "CVE-2026-6873", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:f9a27d30-0fdd-55dc-9c67-9fd23b5e7f1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6873 is fixed in version 5.0.2.post14+tuxcare of django." } }, { "id": "CVE-2026-8404", "affects": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ], "bom-ref": "urn:uuid:c58c63d7-efe4-55c2-af91-7df421e35d4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-8404 is fixed in version 5.0.2.post14+tuxcare of django." } } ], "dependencies": [ { "ref": "pkg:pypi/django@5.0.2.post14+tuxcare" } ] }