{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:02d42394-7c7f-5c1c-b32b-f8fd1a9cafa0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "version": "11.2.1.post10+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@11.2.1", "type": "library", "version": "11.2.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-48379", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:4e41e894-193b-54ba-8dc7-44f316998a5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48379 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:031a1a05-721a-54c9-a81e-c96641f22fb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112390 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:14ddf954-976a-5a94-a713-a8a7a3edbc1a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:598db177-f852-54b4-a2b5-fe2f57951d48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112392 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:3711e428-def0-59d8-8d22-b43dc23b512a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112393 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:6b53f897-d8a0-50d2-842a-f5a43b3513e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:816ca125-41a6-573c-8d0e-b691a0540900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112395 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:ac2c43f0-cbe6-5629-976b-84eb943395c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112397 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:2e7a27a0-2531-5f61-bda6-5d8cde1994b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:203f4303-e529-5d35-a125-4fbf063edafc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112399 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112400", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:9a7c5545-b7e5-5447-85f7-d37fefdda51a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112400 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:a6206283-1545-5b26-ad7a-9734517bcdb6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:58134bcd-4700-5db4-aebb-3ef203834d31", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112402 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:6cc27243-6737-52cf-88f0-85e39b43b4fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112403 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:d9a653f3-128b-59d8-8b23-e70db6f103eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112404 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:a18dcceb-e954-54dd-8b61-ba94872ba624", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112406 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112891", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:44c64fd8-0a6d-564b-b3f4-012fca27b3d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112891 affects version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:8ed0666b-eaf5-5308-956e-1361f592876b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112892 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112893", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:d94d0126-48a0-5da4-97da-a1727a7158ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112893 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:fd46ddf9-a6a3-5a1f-94bd-e66ffcb6b1e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112894 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:dd6a6569-79aa-52c3-8755-0c571059de27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112895 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:463ab7cb-fa3d-5096-8d3e-989f9fd16465", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112896 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:f111f6d4-e18e-5557-96ad-6c053e8ad9a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112897 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112898", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:8cc181cc-8101-5320-97e2-ae50045a78d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112898 affects version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:81daedee-2e3c-50e6-86d2-2ee56ff2bb62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112899 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:4131162c-be98-5194-96db-2e0e690ba57c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112900 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:21e5da50-9972-5bf8-9d53-b7c783525bc6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:9e32e49c-a545-5e44-a98d-dc3a863327fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-114501", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:d2af783b-e0ec-5017-aa3d-b827c8bd6caf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114501 affects version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-25990", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:cb065cca-7948-5f9e-ae1a-4514cc9d7835", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25990 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-40192", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:7fd8f611-69f3-537b-b9bd-52a022c4edb5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40192 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:67ef0199-a0d3-5ec6-ba7a-a6ae477c649f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42308 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-42309", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:8e14b504-1ca5-5785-a52d-6c592e92332e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42309 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:c506302b-e2ad-5824-95d4-6fba55abe045", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42310 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-42311", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:50feb3c8-b311-5cbd-a677-adfed7557fa5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42311 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:65dd96b3-fb70-5cb3-93b1-31cc8c0da96c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:154cf1e7-a7e9-5cbe-9cb4-f3984b9de883", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:8a9886e6-717a-5f0c-97f2-ef50d1c6ae1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:609f62b8-0b9b-5777-8bc2-bc13ac63bb33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:7a2a424e-7d53-5aa7-9dd5-9153475409e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55380 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:aefd0bbd-18a3-5428-a09d-4bf3b3fc758b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:f4721e54-ecf0-5bc6-b938-5f9a3aaaf296", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59197 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:b886abf3-8fa9-51a6-a2f4-5e2ff0307ceb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59198 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:8052a7dc-65aa-5c0d-bf52-34fa19db2e3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59199 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:cddfa7a5-08c2-54f1-8e8c-5c8bff0fafe4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59200 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:57d6c27f-d51b-5d91-aa9b-fc78c5db4ffa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59204 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:2f024a5e-dcf2-5e8e-92a7-b4d7b7a98671", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59205 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:de144ebd-e344-580f-9e02-f66a89358aa9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:2497f20d-2fed-5b2e-9133-a1eef88f705c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96637 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "CVE-2026-96638", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:766af489-32f4-501b-98bd-00acbf7b9cda", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96638 affects version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-96639", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:254ae7ab-210d-5792-8e97-d609c1aa3e9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96639 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:e09ab625-87d9-5525-9dfb-ff0640fca0d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96640 is fixed in version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:57a28400-866d-5d94-a992-fa4716162eb3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 11.2.1.post10+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:3e9f1ed4-57d9-5ec0-b959-e939c6868cc5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96642 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "CVE-2026-96643", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:f86cf66a-ba04-59db-a337-62a7132333b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96643 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:5d97a6fd-2945-5145-be4c-e140847b1585", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96644 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "CVE-2026-96778", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:b633196a-d411-5bcd-854a-70facf50feff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96778 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "GHSA-78g4-xqwv-q3g8", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ], "bom-ref": "urn:uuid:c24fcd76-5c53-5951-8a8b-8cb0d20f9f6f", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.2.1.post10+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository...", "justification": "requires_dependency" } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } ] }