{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ddd7be15-9e00-524a-8b62-b9d478e497cb", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "version": "8.4.0.post4+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@8.4.0", "type": "library", "version": "8.4.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-22815", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:34c9d1a7-3eb7-5e51-aa82-8e3666d61b94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22815 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare." } }, { "id": "CVE-2022-22816", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:3fd30457-0188-5106-a842-c55a2fdf511d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22816 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare." } }, { "id": "CVE-2022-22817", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:0cf21aee-ee0e-5379-b6de-50af6fd3e721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22817 is fixed in version 8.4.0.post4+tuxcare of pillow." } }, { "id": "CVE-2022-24303", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:922e4f93-5dd7-5878-bbbc-1edb779531b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-24303 is fixed in version 8.4.0.post4+tuxcare of pillow." } }, { "id": "CVE-2022-45198", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:11673990-1e54-5263-b0fb-1de177044792", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-45198 is fixed in version 8.4.0.post4+tuxcare of pillow." } }, { "id": "CVE-2023-44271", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:044065e2-6d42-577b-8b84-85033667b113", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44271 is fixed in version 8.4.0.post4+tuxcare of pillow." } }, { "id": "CVE-2023-4863", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:c312fe42-8d5e-5c8f-8178-9b757311300c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-4863 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post10+tuxcare." } }, { "id": "CVE-2023-50447", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:1c0012e6-e993-53ca-a38b-811a32951930", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-50447 is fixed in version 8.4.0.post4+tuxcare of pillow." } }, { "id": "CVE-2024-28219", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:23409a8c-89fc-5d0c-a9a1-827359ca6202", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-28219 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare." } }, { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:f97024b6-580f-51af-a6da-5c347333c7a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112390 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:004eeb4b-00cd-50a5-bc6d-cc07c021344a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 8.4.0.post4+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:fd745763-d104-50fa-9f39-2f942427a2bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112392 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:cb2857ae-2fb1-56c0-a590-b075f6ab0001", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112393 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:178ce6ad-837e-5790-9950-8dc93942654b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 8.4.0.post4+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:7024fd53-fac2-5e73-9da6-9d175a4603b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112395 affects version 8.4.0.post4+tuxcare of pillow." } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:1470ee95-c2d4-5bf3-ac08-8bef52ef5d63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112397 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:53aebfe0-db82-5791-b9d9-f50b38855530", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 8.4.0.post4+tuxcare of pillow." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:507b2cda-6bcf-569c-aa3f-f77deaab7013", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112399 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:519bffbf-e00d-54b5-8732-9add99288663", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 8.4.0.post4+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:b0638328-61f1-52b3-a14e-35c5f27e27da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112402 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:0bd96d31-9b3c-55e9-9410-d53b99a6d11a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112403 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:ff954238-e095-50ce-be80-1de396361b5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112404 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:b0a69d2c-1808-58d2-8314-8922e4b7f509", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112406 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:f5602d2b-4ff8-5fd4-a011-5ce8acc649a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112892 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:16760541-f378-55eb-b683-d99b53f10042", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112894 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:112c5bda-d719-5b78-b2dd-dee4626ee77d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112895 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:65185412-344c-5a87-93bd-e7484d595c04", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112896 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:a5acab00-0cb4-5cba-913b-f2f3ed729ef3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112897 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:2f9e4063-fa53-5cc6-8130-f5a4176b26b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112899 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:8846efcb-3787-5b62-a77e-1bb72a5a14bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112900 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:eb8e664e-105e-5e1c-ad60-aa40ac318f5f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 8.4.0.post4+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:bac2af32-09c3-5c2c-9eab-f1be4e978a90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 8.4.0.post4+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:a635b2c3-1f95-5602-9045-99e39bfaeabd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42308 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:5988c50e-1741-582e-a185-aea9d6c5904a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42310 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post7+tuxcare." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:85c25432-e2ae-508a-8614-b62d6b46cc71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 8.4.0.post4+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:10c46cf1-18ab-51b9-a8a7-cb30d66cf5a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 8.4.0.post4+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:e4298a00-759e-542a-beea-cb68fc6a9533", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 8.4.0.post4+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:209ffcda-c3c4-56e1-83b0-dc853333c759", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 8.4.0.post4+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:803f17dd-a708-54e7-95c5-1f1ac2a9385f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55380 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:96e9f5b4-7ba0-5603-89c7-ae870efcc2b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 8.4.0.post4+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:6a4e8f00-fd9b-56e7-af39-80ac9940da12", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59197 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:f2068ab3-0864-5be1-bab9-3b22de84d215", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59198 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:85b7a952-c28e-574b-b06a-b7ec24e32cea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59199 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:a4ce6752-130a-5d5d-bf60-23ae4317a705", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59200 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:64febc1c-8c2d-5f30-8ab4-73776ba0bcef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59204 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:b577a775-4e4d-5ed0-9b5f-78708b2a0d11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59205 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:6f6ec370-bbc1-52ec-9335-e6ac42f8b7a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 8.4.0.post4+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:7124d080-9cac-5326-9ce7-f2ec39306c8d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96637 affects version 8.4.0.post4+tuxcare of pillow." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:c1de70e6-e13d-57ff-9616-0cc17bad236d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96640 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:c0767524-c51a-5795-9913-d80073eab539", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 8.4.0.post4+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:d1e7fed9-cdaa-5a9a-8dd0-6ede0d299da3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96642 affects version 8.4.0.post4+tuxcare of pillow." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:2d640ef5-1962-5d3c-919a-12e1cc66a642", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96644 affects version 8.4.0.post4+tuxcare of pillow." } }, { "id": "GHSA-4fx9-vc88-q2xc", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:7e02efcb-eea8-5f4e-9df7-dcca93ae14f2", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-4fx9-vc88-q2xc affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post6+tuxcare." } }, { "id": "GHSA-56pw-mpj4-fxww", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:c3a8ad2d-d182-5600-b28e-e75efc7c264d", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 8.4.0.post4+tuxcare." } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } ] }