{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8032d37d-f164-5d40-b84e-7bd3022ee864", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "django", "purl": "pkg:pypi/django@3.2.25.post10+tuxcare", "type": "library", "bom-ref": "pkg:pypi/django@3.2.25.post10+tuxcare", "version": "3.2.25.post10+tuxcare", "pedigree": { "ancestors": [ { "name": "django", "purl": "pkg:pypi/django@3.2.25", "type": "library", "version": "3.2.25" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-45115", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:38536073-2637-53a3-9012-b7afeaceb66f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-45115 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2021-45116", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:d2fb8305-f0a4-5fc9-93a1-b1359083fda9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-45116 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2021-45452", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:98945c6a-b6b5-5a20-a8bb-7624f8a57def", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-45452 does not affect version 3.2.25.post10+tuxcare of django. not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(...", "justification": "code_not_present" } }, { "id": "CVE-2022-22818", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:92ca2bf6-c301-5cb0-982b-bd76e514ce07", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22818 does not affect version 3.2.25.post10+tuxcare of django. not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an...", "justification": "code_not_present" } }, { "id": "CVE-2022-23833", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:c78220db-d2a6-5b3c-973f-f8254a09f44d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-23833 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2022-28346", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:4709cb9c-3d4a-5574-bf18-5ca4b4988b9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-28346 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2022-28347", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:36c9e698-7093-5259-ad0d-263abc0206d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-28347 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2022-34265", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:f3c479d4-ee08-5a88-bdf2-3a6e41a4060c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-34265 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2022-36359", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:dff93f16-a047-5fef-a9cf-c2e3fce37680", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-36359 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2022-41323", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:b1484f69-9860-5b1f-ae25-69940c02a998", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-41323 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2023-23969", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:6213e561-2d86-5ce0-b7c2-e29646b2b5fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-23969 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2023-24580", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:22fefd76-5887-5ed9-b74c-5a4afbd64f8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-24580 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2023-31047", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:9d1c8534-c68b-54e3-a488-98a1aae26be7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-31047 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2023-36053", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:048012c0-e80a-5430-a725-6eab7a98849d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36053 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2023-41164", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:a9a6f3d3-d537-532d-9708-7d2559827848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41164 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2023-43665", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:9d9301eb-6a8c-5b88-a864-494dbdf50f31", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-43665 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2023-46695", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:62b7009a-f8d0-5d96-ab89-4c9e6607b260", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46695 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2024-24680", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:f9a08f2e-dfea-5024-8af7-13f95d0670fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24680 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2024-27351", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:fa417bbe-4d56-59f8-9ccb-1cdf61ef8807", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-27351 does not affect version 3.2.25.post10+tuxcare of django. not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b...", "justification": "code_not_present" } }, { "id": "CVE-2024-38875", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:8abdc39a-3c7e-5f04-a4a5-efcd5774b110", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38875 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2024-39329", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:11fd49ce-8c6a-57dd-b43a-c86e91fc659b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39329 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2024-39330", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:f7d6f5b9-4c31-5382-a857-abb5234154f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39330 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2024-39614", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:c0615d58-be5d-503c-995c-4452bfe18f81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39614 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2024-41989", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:bdecfd88-3c30-5b85-8d4e-c54d53a566b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-41989 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2024-41990", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:df32898b-074c-5f9f-b211-a25c9f7e0784", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-41990 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2024-41991", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:e246af51-1226-5659-9685-b0c03ebe590c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-41991 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2024-42005", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:ca77bbfc-358b-5bb8-aba6-76ecba24eeb8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-42005 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2024-45230", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:bc9c3989-218e-55cd-af76-55980850c75f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45230 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2024-45231", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:21567b0a-c122-52ff-8588-9d1bbf2d8f68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45231 is fixed in version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2024-53907", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:9a70966b-e587-5de8-856b-3db1354f4930", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-53907 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2024-53908", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:75ae9491-8bbe-5fb2-850c-515cf64b91a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-53908 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2024-56374", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:a846fb1b-46aa-597b-acf1-8957ff7cec38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56374 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2025-13372", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:88f37535-7568-5f9c-b1cf-b098a0629f35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-13372 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2025-13473", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:9c2bfa7e-45ca-5892-b6aa-defeb443122e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-13473 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2025-14550", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:34a98b21-5aeb-50fa-a082-d8160cac636f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-14550 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2025-26699", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:db7603fd-0ba4-50f7-a021-7c1c59e4e3a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26699 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2025-27556", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:87323283-f0cb-5232-a6db-56a83530ff7f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27556 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2025-32873", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:463ac2cf-26e5-55dd-a608-45116dc3a68d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-32873 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2025-48432", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:6d3db12d-85dc-5110-b5ce-a4e2a11974d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48432 is fixed in version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2025-57833", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:cd989861-31c4-5a50-a1e4-bec953b94230", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-57833 is fixed in version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2025-59681", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:220e1454-4eaa-5bae-896d-641a255c71fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59681 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2025-59682", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:4ae65401-f607-5a29-ba1b-ac9773c0d59b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59682 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2025-64458", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:19068fd2-f131-51f9-83a7-5e0991e94b1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64458 is fixed in version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2025-64459", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:28a63d7d-fb1e-5694-83ba-f237603fdaa5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64459 is fixed in version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2025-64460", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:235d93c9-1d9a-57d5-bfa0-aeab4d0b62b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-64460 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2026-1207", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:7b0e0842-2b2d-53c1-9daf-cdcbc19cb481", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1207 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2026-1285", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:27cd5c23-b800-5515-839a-009be0c9026e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1285 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2026-1287", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:7c2345cf-97d2-5abd-afa3-5f940875570a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1287 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2026-1312", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:e7a4e3b4-5044-5bee-aff7-79ef4160fe66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1312 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2026-15307", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:141694df-8504-5ab9-bca8-f20690528d02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-15307 is fixed in version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2026-15830", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:9a9436e6-8275-5281-9399-5e17c260d11c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-15830 is fixed in version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2026-25673", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:79765223-ee1d-5d24-a927-9941693b00fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25673 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2026-25674", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:077a25ac-19aa-5432-8e5c-e40e6cebc44c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25674 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2026-33033", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:56e5a9c2-4454-5ffe-a1c8-65d4ffe56729", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33033 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2026-33034", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:0848eceb-ee88-52e0-9bcc-99cc7e61d542", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33034 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2026-3902", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:93b729c8-6552-52ac-be26-17ed357aa9a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-3902 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2026-4277", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:2629a60e-0ca4-5250-b909-18965a6c7526", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-4277 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2026-4292", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:00c08db9-3eea-5333-97a6-80b1bf5e0c1f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-4292 affects version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2026-48587", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:e9173d25-3329-5e9f-b5f6-8e45164058b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-48587 is fixed in version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2026-48588", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:6255ada9-cb2f-5898-8a80-e22ef6dd7174", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-48588 is fixed in version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2026-53877", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:edf2fbb5-70b4-5f4a-b573-a96c348946f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53877 is fixed in version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2026-53878", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:e07dfe2e-5291-5216-a06c-65603e7a976c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-53878 does not affect version 3.2.25.post10+tuxcare of django. not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-6873", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:3f753436-64c4-5a9b-809e-56523e915786", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6873 is fixed in version 3.2.25.post10+tuxcare of django." } }, { "id": "CVE-2026-8404", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ], "bom-ref": "urn:uuid:b415c382-9e29-5231-bc98-9a1a2cf6c3ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-8404 is fixed in version 3.2.25.post10+tuxcare of django." } } ], "dependencies": [ { "ref": "pkg:pypi/django@3.2.25.post10+tuxcare" } ] }