{ "@id": "urn:uuid:10362e59-4643-4439-aceb-6c92a79f42bd", "role": "Document Creator", "author": "https://tuxcare.com", "version": 31, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-27T11:30:22.445084+00:00", "statements": [ { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T21:16:00.126689+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T20:06:00.205274+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-20T20:56:00.091985+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-27T10:34:11.211187+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112891 does not affect version 9.4.0.post7+tuxcare of pillow. not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112891" }, "impact_statement": "not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T21:42:03.750234+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T17:57:08.208128+00:00", "status_notes": "Vulnerability CVE-2026-96644 does not affect version 9.4.0.post7+tuxcare of pillow. not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-96644" }, "impact_statement": "not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is fixed in version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" } } ] }