{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a69953e3-b136-536e-8958-f324864b10f0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "version": "11.3.0.post8+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@11.3.0", "type": "library", "version": "11.3.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:8f7dfc65-7a56-5e6c-820a-369784130c00", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112390 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:f9691dfd-7b76-51f4-85a7-aa3da553bc3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:3ec2e84b-2e60-5771-82a2-d9dc86a1705f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112392 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:a3f5fc54-d8d7-5bdb-a2e0-3b42ebc0a31d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112393 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:a6a220b0-e14f-5bdc-acfd-8088f8308c21", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:9ff8f8d0-fb14-5e71-8394-b642bfd877f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112395 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112396", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:dec49905-8d6c-5448-93c4-b16b9d625719", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112396 affects version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:80f63184-cbd5-5933-9caa-4ca392dfbbca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112397 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:831c6f68-5e77-5be5-861e-aa75e28d1e3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:d44892ae-f500-508f-ae2c-f7dcf7c60de9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112399 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112400", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:34065c36-59ce-5391-8ef2-a9df4eb22030", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112400 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:d49ecb8e-5ffc-5c56-bbf3-de83baa595b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:2b2b622b-c282-5677-a2fe-7b8a4280682d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112402 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:472e9aec-f27c-527c-b9d8-db0d606835f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112403 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:02b5e0f2-5f72-572e-85da-662569f16286", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112404 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:4334657a-8c97-5497-b761-0e2d63e1d40c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112406 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112891", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:42573591-2d1f-5880-a956-a029cd1c1c60", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112891 affects version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:bf7a45cd-bbd9-53c8-b661-7b164fec7e0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112892 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112893", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:db001da1-9142-5ba4-9c73-810840c5504d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112893 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:023e5519-8cd3-5da8-8562-f4ee3a1254d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112894 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:9a4423ba-ec66-5340-9985-faf3ea9d59ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112895 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:60aa6323-674c-5464-a4be-e8a05a9c9a99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112896 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:4cf4cb49-cb19-5363-bb0c-237e2f5248ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112897 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112898", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:c96e4c10-a43c-5a99-848f-cd533cdbb4cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112898 affects version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:de7411c9-b5e1-5008-ae59-bc8504fcb78e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112899 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:1581d847-63a9-5647-b8ef-62510c98881f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112900 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:c6225765-a4a9-5ad4-8f6c-492745bfc954", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:89c45e42-c54b-5f13-838d-bea138feedde", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-114501", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:0e0ab1f5-309a-5bb3-a720-5c0849f01dd0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114501 affects version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-25990", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:e98a24a8-7ed3-546b-9045-dccb8ba85c39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25990 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-40192", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:aca239fe-0d31-5c5d-aaf0-ada898890333", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40192 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:6bcbe784-3569-5d3c-bdd1-b68017d6c883", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42308 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-42309", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:eec3c072-9602-5c9c-bfee-d1a3eed0053c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42309 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:da4f6292-3e93-5d95-b429-a32c1c76fde6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42310 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-42311", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:558175f6-6efa-5a98-a8a0-6d155d3e0b8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42311 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:e4821587-9cba-599f-ab64-60e010f02837", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:79b8654a-c236-5423-a80f-7a3eac97d055", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:38932f9d-9dac-5ea3-acb9-6b50e732dd3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:7a02fe65-e0f8-5fb3-bd23-e19ba099d384", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:fc7e3710-189f-513f-9bf4-3ef87df94c39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55380 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:c345cbfa-5fd4-57ab-b533-5023b2443992", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:897537ba-bf29-5205-b70a-90f9059f28d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59197 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:fa16ab39-d55a-57a5-bb2a-653b481f7c67", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59198 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:c1ebe870-5e13-5b73-bde3-196a3d937b14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59199 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:d8bf0981-140c-5782-8427-c937408d6e02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59200 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:ed0bca8e-c3a0-5f90-a3a8-d859709aa08a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59204 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:22a6584c-d148-5cfe-a6fd-e8b8c01cffa5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59205 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:51bb25cc-b9da-5473-8ee6-880de53028c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:30276ee3-710a-55fb-9c0d-7b934bf885f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96637 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." } }, { "id": "CVE-2026-96638", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:cfb2ace7-8294-5744-bd53-dcddd7da5210", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96638 affects version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96639", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:a1a8a0ea-1fb3-5c4e-8ffb-428a9eaf8f21", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96639 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:87f6d132-e219-530a-b2c1-0fd895220f9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96640 is fixed in version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:1e2f7846-cad1-56d6-a1f4-474a78e7afbc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 11.3.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:00f721de-f660-5dc1-9c53-f602c54ef84c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96642 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." } }, { "id": "CVE-2026-96643", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:98dd05c1-aacf-558b-916a-4d4e2b051001", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96643 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:d00a9491-4fca-5635-8587-f6dc85e80f84", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96644 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." } }, { "id": "CVE-2026-96778", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:bad12ec7-dac9-5a4f-8686-8b8fb8ad09cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96778 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." } }, { "id": "GHSA-78g4-xqwv-q3g8", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:e1b84545-49b9-5e3a-855a-c3bb46775c4b", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.3.0.post8+tuxcare of pillow. not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel...", "justification": "requires_dependency" } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } ] }