{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:156b49c5-84da-55d5-b101-84e34d7a4715", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "django", "purl": "pkg:pypi/django@3.2.25.post5+tuxcare", "type": "library", "bom-ref": "pkg:pypi/django@3.2.25.post5+tuxcare", "version": "3.2.25.post5+tuxcare", "pedigree": { "ancestors": [ { "name": "django", "purl": "pkg:pypi/django@3.2.25", "type": "library", "version": "3.2.25" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-45115", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:7a627c31-6e77-527b-9b41-707a9ad67d88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-45115 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2021-45116", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:d34a99f0-f23f-5cdd-a020-ac3e8e669c53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-45116 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2021-45452", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:08f8a74f-befc-5ece-94a5-f44109683a1c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-45452 does not affect version 3.2.25.post5+tuxcare of django. not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(...", "justification": "code_not_present" } }, { "id": "CVE-2022-22818", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:73c1e93d-4190-5d4c-9aa0-7d3e559c2df3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22818 does not affect version 3.2.25.post5+tuxcare of django. not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an...", "justification": "code_not_present" } }, { "id": "CVE-2022-23833", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:8af5b186-35e6-5ac2-992b-0abf68072521", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-23833 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2022-28346", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:3b5043ab-68f6-5b21-8c47-2a6d19ce2a84", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-28346 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2022-28347", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:57a9e1a2-2907-5398-bb8a-74457d893c23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-28347 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2022-34265", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:4582c857-14d0-51f0-a1be-4be65c088796", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-34265 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2022-36359", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:47f5f51b-3c59-5832-8bd7-b0f45b14fac7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-36359 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2022-41323", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:5505480b-9939-56b6-97a8-d763a14ec914", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-41323 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2023-23969", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:39f80fee-025e-55f8-aaf3-d54e0601a123", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-23969 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2023-24580", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:2fdd3ea9-5a8f-5736-b021-c8afd54e504f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-24580 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2023-31047", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:f8ac5658-70be-5402-9bf1-58e8324d3e66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-31047 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2023-36053", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:53a9a17e-b768-5b3b-8e94-8abf910dc08f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36053 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2023-41164", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:7dc2285e-d89b-5a14-bbf6-5f37d3b18081", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41164 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2023-43665", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:cdd70703-6a0d-59dd-9b8b-1d92c9bdca19", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-43665 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2023-46695", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:5105e194-995c-552f-8baf-f4c2b603861d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46695 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2024-24680", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:0049af49-1f8b-5a17-b4b4-2b641a1e4c5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24680 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2024-27351", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:c9b8ae8c-bcde-502f-8c6e-075941521509", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-27351 does not affect version 3.2.25.post5+tuxcare of django. not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b...", "justification": "code_not_present" } }, { "id": "CVE-2024-38875", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:3a19084f-c43f-5f52-a2e7-407928c6a89c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38875 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2024-39329", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:d888a109-c63a-5125-a095-3fc31a17fb64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39329 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2024-39330", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:25db545a-3c42-5194-9ecd-03a4c96ab750", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39330 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2024-39614", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:0aa8ade5-4f40-5451-9a01-c187ae521ecc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39614 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2024-41989", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:f732fddb-e6b8-5105-8200-dc03d4a564a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-41989 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2024-41990", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:6a145274-752b-5d2c-aba6-f5459bad7cf5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-41990 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2024-41991", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:f413c7f3-c5de-5b79-9ba5-3184a601b62e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-41991 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2024-42005", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:f7fa8951-0eff-5312-91de-adbd76619066", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-42005 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2024-45230", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:1797603e-b229-561a-96a1-6798f227a1e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45230 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2024-45231", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:f51340c5-a34b-58c1-b095-604e971b51c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45231 is fixed in version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2024-53907", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:2310d613-581b-58f2-a257-ae301d2c7498", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-53907 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2024-53908", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:0c36d22d-fd99-569d-876a-1a7374004f51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-53908 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2024-56374", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:e63a460d-240c-5ec2-a581-27ab8e0b3da4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56374 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2025-13372", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:e3c493ad-09cd-59d9-a41d-9acdcbd72157", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-13372 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2025-13473", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:96433205-3e2b-51de-9a9a-3ac905765a16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-13473 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2025-14550", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:8af4945e-b07a-53e2-9288-06c310caf3d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-14550 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2025-26699", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:791f67fc-25e9-5266-8cbc-11eb027d47e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26699 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2025-27556", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:323e519c-8f7e-5e07-8bb8-83e4da561e40", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27556 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2025-32873", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:95b8a62d-9e5d-5d40-9870-4ab3d8dbb21e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-32873 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2025-48432", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:525d724c-2a16-56fe-be5e-b443dced9884", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48432 is fixed in version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2025-57833", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:99f296fb-0ee5-58cd-bac8-f253f5d4559c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-57833 is fixed in version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2025-59681", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:cf773908-e046-5fd0-9d79-e3fa78d4eb7e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59681 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2025-59682", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:fc4c4741-d4df-5507-8d88-348ba554c0af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59682 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2025-64458", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:3a9acddb-821d-5f11-b606-85ba9b7eddc5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64458 is fixed in version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2025-64459", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:6c276267-49c2-5afd-aa36-91d791f1ab8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64459 is fixed in version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2025-64460", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:e81397b8-b1af-51e0-9714-d86c4651ac0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-64460 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2026-1207", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:922f47a7-731f-5c78-9e22-27d21b7c2617", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1207 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2026-1285", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:30b8f5ac-2ea2-53ba-9a01-49c97e1314d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1285 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2026-1287", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:7366c943-9ce3-5690-aa75-58cea1333556", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1287 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2026-1312", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:ee5be692-a24a-5d87-9da0-f028ea508c16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1312 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2026-15307", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:cc52e201-0c87-5b6b-8117-bda608db8bc3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-15307 affects version 3.2.25.post5+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare." } }, { "id": "CVE-2026-15830", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:f6b4bf98-fb15-5c35-b744-d5908dfb11c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-15830 affects version 3.2.25.post5+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare." } }, { "id": "CVE-2026-25673", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:efea6771-efc1-5414-8531-6374c2dfa88e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25673 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2026-25674", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:27dcecb5-1386-518c-b93f-c1009ab4b798", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25674 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2026-33033", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:bf8d548d-3707-5896-8b17-c42cb3c076c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33033 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2026-33034", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:10fa0896-6ee2-5b95-8e99-45aa7b3730d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33034 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2026-3902", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:e99271a2-be87-5f18-aca6-ac1c88c5d391", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-3902 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2026-4277", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:e6683f12-3f2b-546f-889f-bbf7175af380", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-4277 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2026-4292", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:b813b9e6-dcee-55fa-8c36-b009b89be0ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-4292 affects version 3.2.25.post5+tuxcare of django." } }, { "id": "CVE-2026-48587", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:20a4eee0-35fe-52a5-89f9-f747b4a9ab94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-48587 affects version 3.2.25.post5+tuxcare of django, and is fixed in 3.2.25.post10+tuxcare." } }, { "id": "CVE-2026-48588", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:8a1743de-aed7-5699-9788-078738d36605", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-48588 affects version 3.2.25.post5+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare." } }, { "id": "CVE-2026-53877", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:e6f5e5cd-11e1-5895-b5fe-5074eda9175f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53877 affects version 3.2.25.post5+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare." } }, { "id": "CVE-2026-53878", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:5fed507a-6bdf-529f-a9c9-15932f972c62", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-53878 does not affect version 3.2.25.post5+tuxcare of django. not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-6873", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:0feb9a2c-20a4-5821-9e6c-f2c9beec898e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6873 affects version 3.2.25.post5+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare." } }, { "id": "CVE-2026-8404", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ], "bom-ref": "urn:uuid:193fcd5c-c5bd-5f64-8570-2996dc235683", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8404 affects version 3.2.25.post5+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare." } } ], "dependencies": [ { "ref": "pkg:pypi/django@3.2.25.post5+tuxcare" } ] }