{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1559e20b-3ca7-5100-b3be-1bf23ba30890", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "version": "11.3.0.post9+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@11.3.0", "type": "library", "version": "11.3.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:b445ee5f-67f1-5c10-b6cc-9b7b88a364d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112390 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:6ec00bfe-4de7-5931-b8e5-931442d43ea7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:a9ed2c10-9e7f-5aac-b63a-91e40d70b69e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112392 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:2fb94dd4-ea3c-5ebf-a2f7-c6d18b5e0cb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112393 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:d6917138-3de5-56d0-92c8-494fd8dd8453", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:62e1b454-c07a-57d7-a3ae-88a90ec3b4d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112395 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112396", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:ba1ab5bf-3ac8-59cc-8be8-967ac36e5d3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112396 affects version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:4db0af05-859b-5871-980e-fa8c57c06005", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112397 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:6fee7108-86fc-52d6-8f7c-f08e0450d657", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:b30881ec-cd6c-5818-b4d6-46ea0b8000c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112399 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112400", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:4974fac4-cb6d-5396-aed3-df0a5681651d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112400 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:87dedda4-81b1-55fe-b0db-e4ab80a44cb2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:d4dfcbee-88f3-5a28-b842-b8823c2b38eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112402 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:0836d8cf-d3f0-5f15-bee5-833c10245a66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112403 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:85c46b5d-28ad-5603-a68a-b58ad1c8e09f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112404 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:a5c5fd24-dbc2-5198-99d6-abadda4ee825", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112406 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112891", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:60de5aa7-033f-5733-8a74-ccc63fa14fc2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112891 affects version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:2b2dd785-1457-54f4-ba95-6875d36cb4d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112892 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112893", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:67b9e122-d140-57cf-8e7f-0d16df7ecc69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112893 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:4a75bf81-dd45-55b2-9dac-5542dc3c731c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112894 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:de83501a-075a-53f3-8065-45406df5afb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112895 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:3d9df5f0-b935-5554-a5d1-2b5c30dc544b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112896 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:649b2e2f-961a-5eee-988c-715e19e3fe73", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112897 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112898", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:cd86d7e3-568e-5c7b-a5fd-47ec7d1c0274", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112898 affects version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:51fa5b00-b00a-575a-b583-894da72e255f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112899 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:cec62bad-de0f-578f-8a46-b3058e7a729a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112900 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:3a40bf3e-a959-5e77-a764-e4b4beb6d4d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:c7f41e64-4b10-550e-84ee-50d5900beb7f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-114501", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:e3d77a32-d898-563b-9512-4dee920db7c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114501 affects version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-25990", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:d91cd55c-be95-5dc3-b093-697837af062a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25990 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-40192", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:3b14a931-5523-5782-a9fa-eee46df5327e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40192 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:75b2af63-7081-5f6f-9dd4-eca2d818870e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42308 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-42309", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:bb3ea95b-63e2-50e0-8ecd-b937212297c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42309 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:1288f5f7-d3b0-5205-9bf9-c059fe335074", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42310 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-42311", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:ece6f261-88c7-54b9-a4f8-971e3b1f68df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42311 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:996cb272-b076-5515-8f5c-4521b151e21e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:742bec22-9d5b-518e-b345-b9645079680c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:2cc31556-e167-5fa7-b324-ae015b509052", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:35682e63-bbf8-5952-a6ee-064c2a31b6ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:f784ac76-db3e-5094-9d0e-7cfe4826fd7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55380 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:73d52156-383d-566e-b67b-f4f7d0d023ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:d9885507-8113-536c-8829-a671dd80f6b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59197 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:c13e9cca-53b7-523a-a567-50867d9317b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59198 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:5fc219c6-beeb-56a0-8bf2-7bc28bedb3fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59199 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:1ed160cc-029d-5b2f-94bb-12bcb656316d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59200 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:593e8385-56f0-5c91-b2db-f298fecb9299", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59204 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:8c9f3d1b-cb7b-5edd-a4cb-549912546427", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59205 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:a86e46c9-937f-57e5-beba-d9994d4d9aef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:66edf13a-5ca7-5ab9-9c80-1a898bff34f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96637 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96638", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:822b37fc-d3fa-59ae-a022-65136e49d9e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96638 affects version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96639", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:e41bd63d-dc0a-5efd-a0df-b9d3a032d847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96639 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:00d834ac-cf7d-569d-879c-defa0543646c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96640 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:c3171a87-b9c2-5aba-9327-d8b1f76cbc76", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:9113063c-a8f2-590b-87e8-3599bde7e9d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96642 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96643", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:3aa610aa-ea60-5f15-8e67-532c90d247c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96643 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:b0ef6546-e9c5-5338-8d10-c570f4543c06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96644 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96778", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:06cbe52c-b368-578a-a6d1-cc62be9bcfb5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96778 is fixed in version 11.3.0.post9+tuxcare of pillow." } }, { "id": "GHSA-78g4-xqwv-q3g8", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:c06d8857-ccde-5c59-b03b-e6b536e087a2", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.3.0.post9+tuxcare of pillow. not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel...", "justification": "requires_dependency" } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } ] }