{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:63856a2c-4861-5cf6-b729-38f0437b7d30", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "version": "8.4.0.post10+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@8.4.0", "type": "library", "version": "8.4.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-22815", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:cd56a1d4-119c-550a-b64f-36166638522f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22815 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2022-22816", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:800db2dd-042c-5a2b-ab5d-d30033fa2adc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22816 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2022-22817", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:7a57ded4-f04a-5926-9c54-1263a948a511", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22817 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2022-24303", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:48c6c760-e745-5e0b-8448-494fefce986d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-24303 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2022-45198", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:989bc37b-9bf0-5d44-984f-65989470019c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-45198 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2023-44271", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:84b20608-16de-5a91-bdb9-ac21915bf8c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44271 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2023-4863", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:15b881b9-eb20-53dc-b655-7b7d1a12b6be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4863 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2023-50447", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:177724fc-5f3b-5e67-9eb2-f909af56dabf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-50447 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2024-28219", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:f7c83b46-3852-5623-9958-322329a88495", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-28219 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:a37059cb-e37c-5610-8e7c-71635bc2857e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112390 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:7d3bf343-6dab-59f5-b37c-78f2e3b9a2c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:9303f0ea-0894-5731-bb21-edfe4e843d99", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112392 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:902876d6-edf9-5b8a-9e63-efbfeac0de25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112393 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:c7ae51a0-44b4-50df-a48e-255caf9ee1fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:a0ab0569-7b43-5a7c-8342-359f61725938", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112395 affects version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:273d678b-c161-5dbb-a59e-5204ff13a930", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112397 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:88de51e4-e356-5f37-b5b6-989941a4a58b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:da0931ef-1357-5bbb-a7c2-84bc2b30acc8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112399 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:2a94cf68-6af9-5df4-8fae-52e2e9b5079b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:cee13a95-534d-5e4b-8154-9396f9669295", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112402 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:d518b2f5-9a86-5611-8f5e-1a7b54927cf6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112403 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:28ed9626-8758-5aac-947e-23e56e2ce50f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112404 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:58fa4615-fb39-59aa-9080-901797a60c22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112406 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:48abca7c-d9ff-53c4-8e3e-710510fc36f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112892 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:7d4796ed-142e-50b4-aa4c-ad8fba771ded", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112894 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:ccfd8274-9300-5f46-b562-c64b003375f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112895 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:557bd489-bf7c-57af-87c8-9736570a549c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112896 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:7f95a372-f461-5b09-90c3-48f93c46d5d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112897 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:f0c04072-168e-5521-8372-62717718bd4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112899 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:277947dd-5d84-53c9-a372-04e3f3b6d949", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112900 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:2d0337ab-1b9b-5413-8a95-b8b46b330358", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:e2372510-7834-5153-9623-8437639e2c7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:0552c82c-0b4f-5a09-b6e9-2d783ad0523b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42308 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:fb7697e1-6fd7-5fe6-bcc1-28a8736dab95", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42310 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:50623626-2030-5954-966d-c1a407b7a31e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:709ee41e-b765-5010-a573-6735c8bce7a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:848dc614-e9f2-5b91-a7a4-b40fd91e1e20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:3ae658ce-5f8b-5884-a56b-33e8d9a76962", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:1db17fcc-55b8-5099-bfca-87b59ffe2c84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55380 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:dd15ea4d-2267-5ea8-b670-39abad3ccfe3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:25b367a3-d573-5554-894e-5416716fb091", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59197 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:f9fb67cc-b9d3-596e-83c8-a339cd7d4845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59198 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:5a31e026-73c3-5f03-82c9-a5b833a7ad91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59199 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:b220a3bd-1539-5cf9-8332-318f5c475146", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59200 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:4ed6bc83-35bb-5aba-a68e-df8c76868910", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59204 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:425c05d4-71d7-582a-8f44-803a3a582539", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59205 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:7e21cb6d-236b-5fff-bce3-6e4be80d18de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:167dcbb2-30c9-5436-82af-ebe97d3f6c65", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96637 affects version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:7fd2987e-da8b-5e8e-91fd-f84a171f5788", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96640 is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:f3bb0671-e2d1-5e5a-8ac1-984a6e43240c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:8255d398-94d3-55f9-823a-adb04325f206", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96642 affects version 8.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:a3530a8c-5975-5550-b177-21dc89cb40ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96644 affects version 8.4.0.post10+tuxcare of pillow." } }, { "id": "GHSA-4fx9-vc88-q2xc", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:846d0fe9-b277-561d-95c4-c1e02691dd98", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4fx9-vc88-q2xc is fixed in version 8.4.0.post10+tuxcare of pillow." } }, { "id": "GHSA-56pw-mpj4-fxww", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:9bf3e15c-a527-563a-9a71-bab638dec1ac", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 8.4.0.post10+tuxcare." } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } ] }