{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:da668285-66e2-56d7-ae7b-4e393c059008", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "core", "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "type": "library", "group": "drupal", "bom-ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "version": "9.5.11-p7+tuxcare", "pedigree": { "ancestors": [ { "name": "core", "purl": "pkg:composer/drupal/core@9.5.11", "type": "library", "group": "drupal", "version": "9.5.11" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-25270", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:f89397ea-7caf-5507-8095-c4f7c47e1dd7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-25270 does not affect version 9.5.11-p7+tuxcare of drupal/core. not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ...", "justification": "code_not_present" } }, { "id": "CVE-2022-25271", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:de7b8b62-821d-55bf-adb5-3f5684c3cc92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25271 affects version 9.5.11-p7+tuxcare of drupal/core." } }, { "id": "CVE-2022-25273", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:78fbf29a-8a45-5580-ac21-c5782c15db4c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25273 affects version 9.5.11-p7+tuxcare of drupal/core." } }, { "id": "CVE-2022-25275", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:2e27372d-04dc-5572-8cb6-832471c8946c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25275 affects version 9.5.11-p7+tuxcare of drupal/core." } }, { "id": "CVE-2022-25276", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:4fd79ea2-8c1f-5591-a59d-69d84d7ed27e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-25276 does not affect version 9.5.11-p7+tuxcare of drupal/core. not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t...", "justification": "code_not_present" } }, { "id": "CVE-2022-25277", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:13d318da-797d-5d69-bb32-6d3cb6813a3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25277 affects version 9.5.11-p7+tuxcare of drupal/core." } }, { "id": "CVE-2022-25278", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:53992c3c-27dc-5ec7-b37c-af4431194c5b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-25278 does not affect version 9.5.11-p7+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR...", "justification": "code_not_present" } }, { "id": "CVE-2023-5256", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:2c9a004e-77c6-53de-a0bc-1579c035b1d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-5256 affects version 9.5.11-p7+tuxcare of drupal/core." } }, { "id": "CVE-2024-12393", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:80a401d8-37e8-51bc-8032-dcfc8ce46c48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-12393 is fixed in version 9.5.11-p7+tuxcare of drupal/core." } }, { "id": "CVE-2024-45440", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:6f7a9a23-76bb-5a19-b329-5d2e8d9587b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45440 is fixed in version 9.5.11-p7+tuxcare of drupal/core." } }, { "id": "CVE-2024-55634", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:2ff347cf-689d-56c6-a784-9de5d46dd6e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-55634 is fixed in version 9.5.11-p7+tuxcare of drupal/core." } }, { "id": "CVE-2024-55636", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:40b87823-2793-5793-b245-0cc8018f78f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-55636 is fixed in version 9.5.11-p7+tuxcare of drupal/core." } }, { "id": "CVE-2024-55637", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:7788fa40-8f27-532f-8641-21e6a86bbd30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-55637 is fixed in version 9.5.11-p7+tuxcare of drupal/core." } }, { "id": "CVE-2024-55638", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:ab784ad2-d243-5d52-9d32-30d79688e4ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-55638 is fixed in version 9.5.11-p7+tuxcare of drupal/core." } }, { "id": "CVE-2025-13080", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:cfd82f1e-8bbf-5a41-a56a-959f886b9af6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-13080 is fixed in version 9.5.11-p7+tuxcare of drupal/core." } }, { "id": "CVE-2025-13081", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:43b34c8e-492f-5164-88d9-97a3716444fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-13081 is fixed in version 9.5.11-p7+tuxcare of drupal/core." } }, { "id": "CVE-2025-13082", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:8b017fb5-551c-5183-8cc6-44008f03a754", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-13082 is fixed in version 9.5.11-p7+tuxcare of drupal/core." } }, { "id": "CVE-2025-13083", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:adbffff6-5aa0-5119-a847-9ae8484be4cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-13083 is fixed in version 9.5.11-p7+tuxcare of drupal/core." } }, { "id": "CVE-2025-3057", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:57518f31-a944-5ac0-8dda-879fc62e5eca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-3057 is fixed in version 9.5.11-p7+tuxcare of drupal/core." } }, { "id": "CVE-2025-31673", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:fce718e0-4aff-5991-bae1-de776397fec6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-31673 is fixed in version 9.5.11-p7+tuxcare of drupal/core." } }, { "id": "CVE-2025-31674", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:f1f595fc-a36f-5201-bb27-d3f044f64873", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-31674 is fixed in version 9.5.11-p7+tuxcare of drupal/core." } }, { "id": "CVE-2025-31675", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:ee31dde6-048c-524e-9607-d654772dd74b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-31675 is fixed in version 9.5.11-p7+tuxcare of drupal/core." } }, { "id": "CVE-2026-108097", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:0addf332-0c4c-58ca-b7fd-078768d78de9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-108097 is fixed in version 9.5.11-p7+tuxcare of drupal/core." } }, { "id": "CVE-2026-108515", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:54fdd484-4ead-59e1-9a33-23cc47b13393", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-108515 does not affect version 9.5.11-p7+tuxcare of drupal/core. not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-6365", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:201682b5-3738-5f31-9b2c-30b7281493d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6365 is fixed in version 9.5.11-p7+tuxcare of drupal/core." } }, { "id": "CVE-2026-6366", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:a2316e89-58b2-5d16-afb5-3deda7cf9481", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6366 is fixed in version 9.5.11-p7+tuxcare of drupal/core." } }, { "id": "CVE-2026-9082", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:0270c79b-683f-5527-8de1-200583bbbcf2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-9082 is fixed in version 9.5.11-p7+tuxcare of drupal/core." } }, { "id": "GHSA-6ccv-8fgf-cjpw", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:f4974b4c-ca6e-5e44-b011-acb002516978", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 9.5.11-p7+tuxcare of drupal/core. already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs.", "justification": "code_not_present" } }, { "id": "GHSA-6CCV-8FGF-CJPW", "affects": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ], "bom-ref": "urn:uuid:3a620fe1-43ae-53b6-b0fc-d5c62c3ae4dc", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6CCV-8FGF-CJPW is fixed in version 9.5.11-p7+tuxcare of drupal/core." } } ], "dependencies": [ { "ref": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } ] }