{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:14ba39f4-8543-57c8-a8e5-4f5104b7fbf5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "version": "11.2.1.post11+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@11.2.1", "type": "library", "version": "11.2.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-48379", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:5d0aeb4d-c712-59e3-8c1a-ce5fd380b636", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48379 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:dd98c896-c864-561a-abb8-3f3a70f809f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112390 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:7b6d62d6-2d16-5139-8d4b-1f45e0fe4dc3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:c3affd32-eae1-5aa2-9c84-d8b9c7e2c226", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112392 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:47b064ae-68b0-5af6-854f-69db3078986f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112393 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:784cda85-4378-56ed-857a-b01815dfe41b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:3c256a39-b38d-507c-9f06-b7f3a745c529", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112395 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:d2a75794-7992-5069-af8b-65623eeeed27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112397 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:26d20911-83ca-5388-b59e-c179d6ddea23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:b0ea9523-be25-54e7-a56c-a99a7eee1c3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112399 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112400", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:a767bf13-1566-53b1-8b89-834e8fd16836", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112400 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:6f6750d6-672f-56c3-82f3-30d6e11edfd1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:68bcac33-a1fc-52e5-bc51-92d86ed31ba2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112402 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:7ff3b9db-ff3f-5db9-9fd2-37faf92cab3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112403 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:732da104-20ee-5692-b385-3c0bd1ef5a24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112404 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:3cc7dcb6-2b14-5629-b874-f199731147c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112406 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112891", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:906df6fb-e030-5042-84c7-f65a2f7079fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112891 affects version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:95843a27-176e-533d-b1d4-9fa7f325879d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112892 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112893", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:6948a679-8d2d-5908-8c9b-178fd0282d26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112893 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:38fc5fc1-90e9-57e0-8aa2-afe0d6877576", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112894 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:17b31853-76f1-5dee-b14b-c3db14aeec1f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112895 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:a4ec42f0-ce51-554d-adf2-c2aee7b02e06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112896 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:f55ee98b-c4be-59d5-90aa-80d28a232de9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112897 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112898", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:c1a40c6a-0b77-526c-a55e-1380b5b059a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112898 affects version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:34258a51-31a0-5581-a3ca-f525818b4ddc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112899 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:e7ab90a1-5073-500f-be6c-23df510a3d20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112900 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:dfc56032-7a8a-5e7d-8d4b-38c0513c463c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:30119d38-639e-51c8-acc5-25f3834c548d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-114501", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:7a19f4e6-f864-5233-b656-5bc973669318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114501 affects version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-25990", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:a9ffc82b-d9cf-5a2d-b434-e34f410270e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25990 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-40192", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:2b049790-f245-5a8f-8c29-09d6553b3601", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40192 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:5f6b3e82-2f9a-5f38-92a8-9c808ea4d00c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42308 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-42309", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:3d1c94d2-3d53-598b-b208-56e249280dce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42309 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:04642657-5a8e-57c2-adcd-9e495010ffd1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42310 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-42311", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:3c81fea2-a189-525d-9a97-f5c91e6f024d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42311 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:5648e78e-33a6-54d1-aa65-ab7c9f384ec8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:f49e6319-3e11-5828-819b-3304fd12df83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:bd58388f-ea94-58b7-b955-a85ae456c015", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:015b4194-5a81-533e-b5fa-659cda1a4805", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:7ecffea8-bce2-5f67-9eeb-62ff14e4cd47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55380 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:b84fc965-4ac3-520b-8eef-341a87885101", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:a165fdf3-924f-5d5c-ba91-d368ea4369e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59197 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:fdcef03c-00e9-5e09-81ca-9b14a42a411d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59198 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:878274ea-a121-5876-9ead-fb0647bc939d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59199 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:9a80a61b-64f8-580c-b6c0-e167b4e4dcf6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59200 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:4e7e9157-6461-5e4a-9dda-735309293a5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59204 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:54c3926f-bccb-52ce-8a35-9ad3759ce51e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59205 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:e74e4d15-7cc3-51ec-a29c-73049d6395cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:52b040c5-dc19-56cf-979b-2a3921304c38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96637 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-96638", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:b0dc2055-ea45-5651-bf5f-3e9071ad70c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96638 affects version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-96639", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:8a3a3a29-60b0-5537-bd52-46e2f9c12d03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96639 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:4f0b4ce6-a769-53bb-99b7-bee9b023f6ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96640 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:4aaa8bcc-3abe-5e6c-b96a-732476e26107", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:22ef80c1-80d1-5e06-9061-8f39db3faa41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96642 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-96643", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:1a4c3ed4-7dfb-54bb-82ad-a3707e26a399", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96643 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:e6dee6c2-a771-5a6e-aece-263f6e2c342f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96644 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "CVE-2026-96778", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:6729797f-22e4-5587-9fc5-70df9af2c89f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96778 is fixed in version 11.2.1.post11+tuxcare of pillow." } }, { "id": "GHSA-78g4-xqwv-q3g8", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ], "bom-ref": "urn:uuid:1c03fceb-0ee5-5055-965a-3132981be13c", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.2.1.post11+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository...", "justification": "requires_dependency" } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } ] }