{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7c2f0163-1b24-5fba-88b1-6d73bcb93411",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "virtualenv",
      "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare",
      "type": "library",
      "bom-ref": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare",
      "version": "20.39.1.post3+tuxcare",
      "pedigree": {
        "ancestors": [
          {
            "name": "virtualenv",
            "purl": "pkg:pypi/virtualenv@20.39.1",
            "type": "library",
            "version": "20.39.1"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "AIKIDO-2026-10495",
      "affects": [
        {
          "ref": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:67aa7922-567f-5858-afa8-de72fd4759ba",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability AIKIDO-2026-10495 is fixed in version 20.39.1.post3+tuxcare of virtualenv."
      }
    },
    {
      "id": "CVE-2026-102925",
      "affects": [
        {
          "ref": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:8e791a16-e594-526e-b133-b013c6ae0273",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-102925 is fixed in version 20.39.1.post3+tuxcare of virtualenv."
      }
    },
    {
      "id": "CVE-2026-102930",
      "affects": [
        {
          "ref": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:5ccc4bdd-5f3b-5843-abe0-7db79e5e81a8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-102930 is fixed in version 20.39.1.post3+tuxcare of virtualenv."
      }
    },
    {
      "id": "CVE-2026-102937",
      "affects": [
        {
          "ref": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:aef22bef-75bd-56f3-9b9a-1a3397a733de",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-102937 is fixed in version 20.39.1.post3+tuxcare of virtualenv."
      }
    },
    {
      "id": "CVE-2026-102938",
      "affects": [
        {
          "ref": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:c93374b3-c895-5d3f-b02a-11974db056ac",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-102938 is fixed in version 20.39.1.post3+tuxcare of virtualenv."
      }
    },
    {
      "id": "CVE-2026-113714",
      "affects": [
        {
          "ref": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:b9e01d5e-1c8d-5664-ba9c-799f1ff3fec5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-113714 affects version 20.39.1.post3+tuxcare of virtualenv."
      }
    },
    {
      "id": "CVE-2026-113715",
      "affects": [
        {
          "ref": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:13730de7-f025-5440-8a22-b5c13d94d394",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-113715 affects version 20.39.1.post3+tuxcare of virtualenv."
      }
    },
    {
      "id": "CVE-2026-113716",
      "affects": [
        {
          "ref": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:2ad6b967-0a3a-5cfd-9a50-4b9971aaa056",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-113716 affects version 20.39.1.post3+tuxcare of virtualenv."
      }
    },
    {
      "id": "CVE-2026-113717",
      "affects": [
        {
          "ref": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:c9e5678f-fb10-5cfa-9b0a-8414ec4e0de9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-113717 affects version 20.39.1.post3+tuxcare of virtualenv."
      }
    },
    {
      "id": "CVE-2026-113718",
      "affects": [
        {
          "ref": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:4f9fd200-c127-5439-bd68-adc9b9857ce7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-113718 does not affect version 20.39.1.post3+tuxcare of virtualenv. not_affected \u2014 CVE-2026-113718 concerns code injection in virtualenv's xonsh activation script generation through multibyte encoding confusion. The xonsh activator module was completely removed from virtualenv in version 20.7.0 (July 2021, commit 1afc1900). The target version 20.39.1 is significantly later and does not contain any xonsh activation code. Exhaustive searches confirm the vulnerable code path doe...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-113719",
      "affects": [
        {
          "ref": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:7a407691-657e-5a98-9e9f-3c71adc20444",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-113719 affects version 20.39.1.post3+tuxcare of virtualenv."
      }
    },
    {
      "id": "CVE-2026-113720",
      "affects": [
        {
          "ref": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:4a61562c-fb3c-5034-9fbb-0e29ac95a1a9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-113720 affects version 20.39.1.post3+tuxcare of virtualenv."
      }
    },
    {
      "id": "CVE-2026-113721",
      "affects": [
        {
          "ref": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:bdfe2b66-76ac-52fc-b827-40cbbcdceaa9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-113721 affects version 20.39.1.post3+tuxcare of virtualenv."
      }
    },
    {
      "id": "CVE-2026-113722",
      "affects": [
        {
          "ref": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:63d44349-81ca-518d-84ec-bd0234715a6b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-113722 affects version 20.39.1.post3+tuxcare of virtualenv."
      }
    },
    {
      "id": "CVE-2026-113723",
      "affects": [
        {
          "ref": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:49676fb6-ecfa-5d50-99de-5ea75a45a5be",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-113723 affects version 20.39.1.post3+tuxcare of virtualenv."
      }
    },
    {
      "id": "CVE-2026-113724",
      "affects": [
        {
          "ref": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:8881af83-0e18-59b2-8d38-9ef6fa5eca6e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-113724 affects version 20.39.1.post3+tuxcare of virtualenv."
      }
    },
    {
      "id": "CVE-2026-113725",
      "affects": [
        {
          "ref": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:09b037f8-04e8-5c9c-82f4-50048894ec89",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-113725 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post4+tuxcare."
      }
    },
    {
      "id": "CVE-2026-113726",
      "affects": [
        {
          "ref": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:81299bed-a6df-55d2-80ae-f1216d730482",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-113726 is fixed in version 20.39.1.post3+tuxcare of virtualenv."
      }
    },
    {
      "id": "CVE-2026-113732",
      "affects": [
        {
          "ref": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:ea68ae22-7b14-5e01-904e-c1e17e320a70",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-113732 is fixed in version 20.39.1.post3+tuxcare of virtualenv."
      }
    },
    {
      "id": "CVE-2026-113776",
      "affects": [
        {
          "ref": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:e516554e-4ebe-5217-b3ef-a8c752ae3611",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-113776 is fixed in version 20.39.1.post3+tuxcare of virtualenv."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
    }
  ]
}