{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:39f80166-0bdc-5d9d-84d8-1325a2b20d99", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "version": "11.2.1.post12+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@11.2.1", "type": "library", "version": "11.2.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-48379", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:3dc90b32-6cb9-55f8-bdcd-adca55b888ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48379 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:da61819c-2ffd-5ef9-8955-c97bd8a96424", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112390 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:89c6ccd1-bd73-550a-ac91-d0eefb7bbd52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:926f01f0-6784-53d0-8730-092a81fef512", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112392 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:b613d8b8-2569-518c-b9bb-6dd2506968f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112393 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:f53e25ab-2db6-5eb1-97a9-e01ab34ce050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:3e57115b-7ef9-5195-b40c-7af7c6df81cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112395 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:68407f82-dd88-5a33-adc0-1c4a49e772af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112397 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:36cecb7c-5ee5-51cf-99d8-0201d0af9e68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:88e5d948-5918-5e5c-9e4f-e95c3c6250f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112399 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112400", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:e088edbe-fcaf-57ed-9a10-21b448aad7d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112400 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:922b8cfe-96f4-50be-aacb-aaf5efdddec1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:50c1422b-c848-5b4f-aa4c-4f8744da0628", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112402 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:2b09eda1-05d8-5014-97e2-50cef8a085f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112403 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:d170095f-1153-596e-b70c-e9b38ed87c5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112404 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:8c0a35e5-f841-5400-8e0f-b09b8921adcf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112406 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112891", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:15a13b6e-f231-5693-b1d3-ec1a13c83528", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112891 affects version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:546cae81-fd95-529e-acd4-7de6914fb8b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112892 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112893", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:470a0581-2bd9-56c3-8461-5e9122a35949", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112893 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:bab91d39-d62d-5d09-acb0-392fa6b33628", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112894 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:41cc260e-375e-5b4d-8a67-9567196199a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112895 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:4cb18aef-2dea-54d4-b0fd-1c78f6c05a1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112896 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:e71de33f-6e5e-5d2a-98ff-d9c46272859c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112897 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112898", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:ba23213e-978e-5245-8ab0-a5a9dc0d4df8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112898 affects version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:d1d83746-5375-577b-98f3-980f51d3455c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112899 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:feb8207d-2add-5618-b592-fa228e5a528c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112900 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:f0507f25-83bd-58fa-88b0-e4995b0daf1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:7f757a00-0ec3-5575-ad54-a56998da915b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-114501", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:b10efcb8-da6b-5206-a02d-5a7827a4245b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114501 affects version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-25990", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:9e0691f2-7dd6-5b6d-81d9-55df75129ea1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25990 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-40192", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:e0e420d0-6962-5d1f-8eab-63dee5ba1be3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40192 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:30707c04-ab37-51ce-86bb-dba74d21fbc2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42308 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-42309", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:68d8196c-4fed-5c6b-8d60-9024f4ea4041", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42309 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:d5837085-c18a-510d-97eb-f94a182adf2f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42310 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-42311", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:a4ef6e56-17dd-5de4-8c47-954febb47188", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42311 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:9c0fbeb9-3f27-5267-a9b7-be35df3cf54b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:0b20de50-df68-5014-b895-fd3b8ebec51f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:28e0708d-002e-55a5-83f0-261fabff3be8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:45784004-186e-55fc-800c-a5c5a8694456", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:ad6c59dc-675d-50de-8699-afa23af69a85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55380 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:bfc71a3a-9158-5607-a599-cb9d898f2a94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:475a5510-4a90-5257-a320-e8b90ab3eaec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59197 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:1e91f1b7-dea5-5770-a432-1629fe741907", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59198 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:f78003e2-bccd-5919-8de0-d16a047d11a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59199 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:6b103ded-3356-5f0e-8308-5e4b0f04bdc4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59200 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:f05baa82-42b6-5f5e-8a7d-404544bec0dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59204 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:ece3b537-671f-50c3-a8f7-2069940c0c32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59205 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:ee9c2a7a-eb37-5cde-a289-3958e9f3a44c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:a7d488a0-787e-541c-87b2-9fb60eab51c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96637 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-96638", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:ac4243c9-8758-5343-b51a-777fbafed515", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96638 affects version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-96639", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:ebfd735b-6488-5952-8b0a-0ef940131915", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96639 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:b39ece61-2fbe-58ae-bca9-fc1a49c502c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96640 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:61ef8e9a-4110-5f6d-90d9-0cecbe72f10d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:93c410b1-c99e-5fc9-a108-8d0145c21c48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96642 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-96643", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:3c3818c4-1654-5506-8096-8e5983bc1b0a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96643 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:330910c0-3d3e-586c-be6f-9157ba3a97e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96644 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "CVE-2026-96778", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:967ad30e-6282-5116-8274-2d715f4bc14d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96778 is fixed in version 11.2.1.post12+tuxcare of pillow." } }, { "id": "GHSA-78g4-xqwv-q3g8", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ], "bom-ref": "urn:uuid:1e9f07f3-37b5-50ca-98f2-1548535fb37b", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.2.1.post12+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository...", "justification": "requires_dependency" } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } ] }