{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7d095552-0588-5038-ac00-32c03e5a84cd", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "django", "purl": "pkg:pypi/django@3.2.25.post6+tuxcare", "type": "library", "bom-ref": "pkg:pypi/django@3.2.25.post6+tuxcare", "version": "3.2.25.post6+tuxcare", "pedigree": { "ancestors": [ { "name": "django", "purl": "pkg:pypi/django@3.2.25", "type": "library", "version": "3.2.25" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-45115", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:f4c36381-04dd-5cc7-9d8b-59668005ad37", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-45115 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2021-45116", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:c3ed6a6d-0c93-5cc4-aad5-156c3883056c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-45116 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2021-45452", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:d7f7f13d-4f1b-5d4b-9d67-f3481decedb1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-45452 does not affect version 3.2.25.post6+tuxcare of django. not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(...", "justification": "code_not_present" } }, { "id": "CVE-2022-22818", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:0359c9b8-3eb3-5b23-8a65-98c303724635", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22818 does not affect version 3.2.25.post6+tuxcare of django. not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an...", "justification": "code_not_present" } }, { "id": "CVE-2022-23833", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:8d953fb1-f730-5ce6-822d-8fc6a07398c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-23833 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2022-28346", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:ae2a8e8a-2726-5612-8296-48fbfa7b5ef0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-28346 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2022-28347", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:90ccf5e1-bb3b-51a0-a2a0-01d576d31649", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-28347 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2022-34265", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:fbae6753-6994-589d-bb2d-cea3784cf054", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-34265 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2022-36359", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:f34c208e-2f91-5f26-91dc-fc98ccbf981b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-36359 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2022-41323", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:9a4d9a95-02fa-56ac-9782-6c7f56f6fffb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-41323 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2023-23969", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:a7a205d2-0524-5dc6-b30f-10d2ff989287", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-23969 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2023-24580", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:2b6c8fad-e2a0-5a48-bf67-f5f96f5cf469", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-24580 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2023-31047", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:c37db96e-b21b-5fb2-843c-8556570ae77f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-31047 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2023-36053", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:59f609b9-a178-5328-be1a-fd6101c1721d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36053 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2023-41164", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:f4f1d59b-cf78-5c92-9692-f7cd54f8e3b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41164 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2023-43665", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:b6e67e3b-b974-54cc-8fd8-a4135373b862", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-43665 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2023-46695", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:13980816-d74c-5d54-b365-7748a8d3ce49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46695 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2024-24680", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:72fa960d-ec68-5e7e-b928-3a4b056dc56a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24680 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2024-27351", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:fe66fdd3-e1e4-58dd-9abd-714dcec17aff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-27351 does not affect version 3.2.25.post6+tuxcare of django. not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b...", "justification": "code_not_present" } }, { "id": "CVE-2024-38875", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:dbe61ab5-48ea-5171-ae62-cf259b50c446", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38875 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2024-39329", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:99fbfbfa-4190-59a9-ad9b-f1360cf912a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39329 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2024-39330", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:2c494229-4d5d-5f4a-a3bc-48ffc480b168", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39330 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2024-39614", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:fe2bdc7b-7940-5fac-8e0e-a204946faa67", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39614 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2024-41989", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:4a48b7b7-52fc-5e1d-a8e3-8e5d254dc1a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-41989 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2024-41990", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:6bdbdc79-246e-5d77-9511-9755f3968668", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-41990 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2024-41991", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:fd41e898-af22-5227-9551-5ed347022b05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-41991 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2024-42005", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:a964c7a7-fcb6-5a98-afe0-49b746d2a951", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-42005 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2024-45230", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:f2d2312e-993c-5d3d-8dfb-02448aed4aa2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45230 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2024-45231", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:4dab9178-bb98-5f8c-a860-b3159d9c9197", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45231 is fixed in version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2024-53907", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:7bd9aa9e-ad09-59ce-a657-98d9168559aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-53907 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2024-53908", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:a02c1ac1-3c86-5485-a5b4-23a11559de82", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-53908 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2024-56374", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:09ac3a08-45eb-51e1-9193-ee733614a8a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56374 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2025-13372", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:f8834d08-f422-5857-89ee-913e5b42f85d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-13372 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2025-13473", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:3ff5a931-c20d-5231-bfd0-12f071d94e63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-13473 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2025-14550", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:dd5c1049-5cb5-5756-b01e-987653dcc987", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-14550 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2025-26699", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:990afce4-94bf-502a-b004-f60bade8781e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26699 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2025-27556", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:48cc6fbb-9109-55b5-b490-180b64fc04db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27556 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2025-32873", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:ae5a91e8-8aec-55a4-8cd7-171dd84f4acf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-32873 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2025-48432", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:585a0af1-9b4a-5f1a-9a36-9fc78ac42e8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48432 is fixed in version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2025-57833", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:86926964-06e7-5858-8147-63d04f87ba8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-57833 is fixed in version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2025-59681", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:007d0893-cbe0-5d51-a065-44cdfbfafebf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59681 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2025-59682", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:9372b734-7538-5c01-92ab-9687337b03bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59682 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2025-64458", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:7bcc02bd-fd2d-5fe9-8f58-5966f3c8edde", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64458 is fixed in version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2025-64459", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:d09de3fc-81cc-5884-9382-94944dc99457", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64459 is fixed in version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2025-64460", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:c0f07c0f-1685-55d8-8405-84a52f34bb61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-64460 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2026-1207", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:ce818a63-3f1d-5b28-9033-d858a183e198", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1207 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2026-1285", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:5d6010d9-b476-531c-82d5-495c952548c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1285 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2026-1287", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:b901f914-9a66-58c2-8654-afa02e1ae8ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1287 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2026-1312", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:4d0ba250-3747-59a7-a944-47361ced04dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1312 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2026-15307", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:7b8a6aa1-7235-585e-ba60-5e2dbfb7e633", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-15307 affects version 3.2.25.post6+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare." } }, { "id": "CVE-2026-15830", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:554b839e-fdab-58b0-a003-82f63d736357", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-15830 affects version 3.2.25.post6+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare." } }, { "id": "CVE-2026-25673", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:ebd08a77-fa0a-5199-b647-28447f9fa3e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25673 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2026-25674", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:94bffd6e-37fc-523e-8f93-eb2fe88e0751", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25674 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2026-33033", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:58b5b376-def7-5156-b11f-ac3e203723bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33033 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2026-33034", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:35d7a202-bf55-5e93-a64a-df2500d28127", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33034 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2026-3902", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:eeced9f5-390f-58a5-9e12-b42e40171138", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-3902 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2026-4277", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:1d5c8b95-b4ad-56e9-9d1a-b76d0cd3d74e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-4277 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2026-4292", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:c49c9e33-3c7c-5d01-b1e3-bcef0b2e220a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-4292 affects version 3.2.25.post6+tuxcare of django." } }, { "id": "CVE-2026-48587", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:a511d48c-140f-5a58-985a-b6f94f81a747", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-48587 affects version 3.2.25.post6+tuxcare of django, and is fixed in 3.2.25.post10+tuxcare." } }, { "id": "CVE-2026-48588", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:3acd1fa4-17ff-55d9-987f-43fe30c6f35a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-48588 affects version 3.2.25.post6+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare." } }, { "id": "CVE-2026-53877", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:ec2d0c07-9858-55be-bae4-9557831b0363", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53877 affects version 3.2.25.post6+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare." } }, { "id": "CVE-2026-53878", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:fe04ac9e-782a-5bcf-8006-7176f3089bf2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-53878 does not affect version 3.2.25.post6+tuxcare of django. not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-6873", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:33ce39c0-11a2-52a5-82a7-a9fe06dd1160", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6873 affects version 3.2.25.post6+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare." } }, { "id": "CVE-2026-8404", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ], "bom-ref": "urn:uuid:30160bad-3389-5dbf-a8fc-54c8dffde231", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8404 affects version 3.2.25.post6+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare." } } ], "dependencies": [ { "ref": "pkg:pypi/django@3.2.25.post6+tuxcare" } ] }