{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0c072470-5359-5965-9488-f87236d1ac17", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "django", "purl": "pkg:pypi/django@3.2.25.post7+tuxcare", "type": "library", "bom-ref": "pkg:pypi/django@3.2.25.post7+tuxcare", "version": "3.2.25.post7+tuxcare", "pedigree": { "ancestors": [ { "name": "django", "purl": "pkg:pypi/django@3.2.25", "type": "library", "version": "3.2.25" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-45115", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:3a682640-9aff-597e-b420-f5f741758760", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-45115 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2021-45116", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:5674706b-64ca-5ac6-a708-94ff1b93ca0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-45116 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2021-45452", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:605624d1-0f6a-5b87-b383-0bb40712219c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-45452 does not affect version 3.2.25.post7+tuxcare of django. not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(...", "justification": "code_not_present" } }, { "id": "CVE-2022-22818", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:3ed5559c-96da-5643-ac0f-d75add5ab261", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22818 does not affect version 3.2.25.post7+tuxcare of django. not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an...", "justification": "code_not_present" } }, { "id": "CVE-2022-23833", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:b907989d-f2ed-5031-8557-9cc927ca367b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-23833 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2022-28346", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:b6be97fb-9c93-54f2-8dda-dc15f835fc83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-28346 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2022-28347", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:2d05b4c0-74b3-5da3-ac61-39509c43b5c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-28347 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2022-34265", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:c6535ed8-3fa6-5fbf-a9bb-68cbbd4b7321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-34265 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2022-36359", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:a61abc95-0aa5-51d6-a02d-921da01ee005", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-36359 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2022-41323", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:4d502468-9588-5d78-a6f2-ce9f73db1e1a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-41323 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2023-23969", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:0b31b0e5-0b8b-5b37-b42d-0850e7182e7e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-23969 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2023-24580", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:9c284321-a31d-599f-8ee8-8190f42a1474", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-24580 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2023-31047", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:46ff36ec-55b2-5eb4-9f05-81791ce094a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-31047 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2023-36053", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:f4c219ac-d69f-5721-9152-795f154a66ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36053 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2023-41164", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:321ecb1f-fc81-5f68-907d-dd1e63aed9e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41164 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2023-43665", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:cef7378d-1388-5f20-8306-911e5bf3dd2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-43665 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2023-46695", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:392a91d6-6ad5-58ef-9997-1b02ec8b1c20", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46695 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2024-24680", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:f8f8c455-5baa-5ef9-9cdb-50176d3fd60a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24680 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2024-27351", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:1b366c2e-093d-50e1-a1e2-87300986cf7c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-27351 does not affect version 3.2.25.post7+tuxcare of django. not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b...", "justification": "code_not_present" } }, { "id": "CVE-2024-38875", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:f41fcdca-34d9-5710-a400-6a299e476567", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38875 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2024-39329", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:697c9656-0739-567c-8940-9204ef151bcc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39329 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2024-39330", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:7f7098e1-b705-5558-a820-6b1bb93cf032", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39330 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2024-39614", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:7594a24c-2835-581b-8dce-16af2e286f1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39614 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2024-41989", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:347f07dc-111a-53f3-b4cb-255860e057a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-41989 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2024-41990", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:1d37f259-ff51-5365-aac6-8ee9df80a58d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-41990 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2024-41991", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:303892b2-31ab-5fe5-9042-a5babc87722d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-41991 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2024-42005", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:95446071-881a-5a24-a17b-9000fcef1f58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-42005 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2024-45230", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:46d0b367-0fea-544b-ae91-f2d040d03d1f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45230 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2024-45231", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:6d25f645-225d-5863-942d-8e2af2ee01f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45231 is fixed in version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2024-53907", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:3ae18226-bcf0-5b05-8f6e-ccafb6817d12", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-53907 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2024-53908", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:408a4d01-8cc7-5bd3-bf41-370027e5cbf8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-53908 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2024-56374", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:1b849dc0-5729-544b-b346-30e9d914ae98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56374 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2025-13372", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:7ece8ec4-e9e5-5964-9f10-85249088e175", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-13372 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2025-13473", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:e568427e-7e62-5a5b-99b9-d7c3057141ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-13473 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2025-14550", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:41305ae9-8e3e-5bb2-95ea-7a253b829b5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-14550 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2025-26699", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:de7fb248-8721-5d99-b6d2-7969734698ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26699 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2025-27556", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:8992f6a0-1732-5adf-96c5-bad2611ad3bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27556 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2025-32873", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:d5f989fc-3d2c-5770-9d69-d140a69b85a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-32873 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2025-48432", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:4a19f946-a804-5a2b-9060-38b2dcdcfe8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48432 is fixed in version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2025-57833", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:53eb8620-bf17-5f2c-9e6e-9b97f85b462d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-57833 is fixed in version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2025-59681", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:c6a2fc87-2b24-56c6-8347-01e5392fec83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59681 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2025-59682", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:bda19ed9-8257-5bd8-80c8-00975b7357d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59682 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2025-64458", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:3228edd8-6c4b-5067-a18d-e2c06c7ceb6d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64458 is fixed in version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2025-64459", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:25ae8485-62fa-5349-abc2-8cdbff7b67b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64459 is fixed in version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2025-64460", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:903f1c26-8a56-5b37-9cbc-c37f4b19eabd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-64460 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2026-1207", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:640123bc-f539-5f52-bb4d-e2c6805df531", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1207 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2026-1285", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:e361fa1c-8b2c-5123-bb37-5bca96b38b0c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1285 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2026-1287", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:5583b1fb-2825-5012-b7c4-f448bcc6e84c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1287 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2026-1312", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:52cfd776-d451-5be8-a110-9a780f08ab84", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1312 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2026-15307", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:3c60280a-a9d5-5df8-8d17-fdccf9d08482", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-15307 affects version 3.2.25.post7+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare." } }, { "id": "CVE-2026-15830", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:1287471c-dced-54c3-9f64-c5e9bd165a24", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-15830 affects version 3.2.25.post7+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare." } }, { "id": "CVE-2026-25673", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:13590231-6a12-5687-8c75-1cf1cc519917", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25673 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2026-25674", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:fc776a9b-f6a8-5d70-8d0a-b05a056e598a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25674 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2026-33033", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:fe8254f2-67c8-524c-af09-16418f7b04c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33033 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2026-33034", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:d07eac4a-c7eb-5082-a175-e94d62ff11e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33034 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2026-3902", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:af8e2358-75eb-5b38-83aa-9c5666f3bd39", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-3902 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2026-4277", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:48a99397-f4cd-5146-b350-71c15f729eb5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-4277 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2026-4292", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:6b222f27-92f7-5e77-82b5-6bef1a351212", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-4292 affects version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2026-48587", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:28c1a8a5-c97b-50a7-be79-dd55a915eff3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-48587 affects version 3.2.25.post7+tuxcare of django, and is fixed in 3.2.25.post10+tuxcare." } }, { "id": "CVE-2026-48588", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:5dfaa9a2-9dc8-527f-9ca3-9ba85ae9a3fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-48588 is fixed in version 3.2.25.post7+tuxcare of django." } }, { "id": "CVE-2026-53877", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:2e1392c3-f57d-5610-b0b6-5e36c8b81251", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53877 affects version 3.2.25.post7+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare." } }, { "id": "CVE-2026-53878", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:98b475b3-88fb-539c-bc5e-b3485adf1865", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-53878 does not affect version 3.2.25.post7+tuxcare of django. not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-6873", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:d283a3e5-5f7a-5e6f-a02d-5dae7f2289bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6873 affects version 3.2.25.post7+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare." } }, { "id": "CVE-2026-8404", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ], "bom-ref": "urn:uuid:7f12485d-f011-57fa-8456-baf6d9a10e4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-8404 is fixed in version 3.2.25.post7+tuxcare of django." } } ], "dependencies": [ { "ref": "pkg:pypi/django@3.2.25.post7+tuxcare" } ] }