{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:407db5bd-c87c-5249-b0ec-5638e4d6969f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "django", "purl": "pkg:pypi/django@3.2.25.post8+tuxcare", "type": "library", "bom-ref": "pkg:pypi/django@3.2.25.post8+tuxcare", "version": "3.2.25.post8+tuxcare", "pedigree": { "ancestors": [ { "name": "django", "purl": "pkg:pypi/django@3.2.25", "type": "library", "version": "3.2.25" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-45115", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:b4516e5d-88c6-5d0e-a876-1eb05b36adb7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-45115 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2021-45116", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:56be3243-4626-5b21-b3f1-f79de653f27e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-45116 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2021-45452", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:e2067b3c-621b-5074-8752-60cc30152797", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-45452 does not affect version 3.2.25.post8+tuxcare of django. not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(...", "justification": "code_not_present" } }, { "id": "CVE-2022-22818", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:a720a5f3-1acc-54d5-ae51-cafdabce3e92", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22818 does not affect version 3.2.25.post8+tuxcare of django. not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an...", "justification": "code_not_present" } }, { "id": "CVE-2022-23833", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:aaf57d68-98a6-5df9-a3b3-6b1bc8ccadcf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-23833 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2022-28346", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:80de45cb-8239-52b7-9f19-aad08883e7c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-28346 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2022-28347", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:c0705309-2153-5c73-9690-370ee25cd5da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-28347 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2022-34265", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:0c46b8c1-e3f6-5aa0-a8d1-3e1e5c1f9c3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-34265 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2022-36359", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:1c9eadc7-865f-5b20-983b-4b9b251c88cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-36359 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2022-41323", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:7d6ffa5b-0f19-5673-befc-efd86b1f2b21", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-41323 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2023-23969", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:a348970c-ad10-5201-bdd8-09d4638ee15f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-23969 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2023-24580", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:4db8a576-b226-5b9a-ac96-6cd0a15e9362", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-24580 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2023-31047", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:4947faa3-89ca-5729-b3b5-036dff4d4c38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-31047 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2023-36053", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:ef861dd5-8b7f-59b7-b6ee-3661cfd2730c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36053 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2023-41164", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:17792020-ec59-5400-ba8a-e11baecdf141", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41164 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2023-43665", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:e259c50c-4d61-54a7-9582-4d1ef1a03ac4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-43665 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2023-46695", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:909a9f02-de6f-591e-bbc3-dee13d2d27db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46695 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2024-24680", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:9ceb37be-43f8-58c6-8a4d-1d5739127d3a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24680 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2024-27351", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:5ae53f5f-a2ea-5de5-a293-de33408128a3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-27351 does not affect version 3.2.25.post8+tuxcare of django. not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b...", "justification": "code_not_present" } }, { "id": "CVE-2024-38875", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:012a4d10-43d2-5a32-b287-6b4ae8448637", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38875 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2024-39329", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:1df5c42f-29b7-57e6-9a21-08f186f9a7e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39329 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2024-39330", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:8a9f3e90-1aa0-58a4-a4ba-afc121c324f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39330 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2024-39614", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:eed49228-f67f-5abe-bacf-494741a760b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39614 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2024-41989", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:530c5ac7-949b-59e1-8e3f-5c1af3bc0604", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-41989 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2024-41990", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:700804f4-8b3d-579f-9c2a-4bca998ecc91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-41990 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2024-41991", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:8540eeb7-4479-5845-9fed-9ff270605ba1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-41991 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2024-42005", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:79756bdf-c7dc-52c7-b2b1-69652b93bc7e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-42005 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2024-45230", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:338b2d30-9352-509a-8b9f-232b78dbcd0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45230 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2024-45231", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:683d04bc-0e43-5c27-b248-4e167a82ba47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45231 is fixed in version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2024-53907", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:42510eff-5144-5f04-a1d8-9e59226c2f1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-53907 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2024-53908", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:d79e5176-b88b-586c-89a8-ec95c850b062", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-53908 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2024-56374", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:169653ca-adaa-5997-8f99-8c5b2a4b957e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56374 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2025-13372", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:76c9a38e-9a4c-5391-89e3-b58a62264148", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-13372 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2025-13473", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:61438ced-b93e-5770-ade6-a99b75b48892", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-13473 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2025-14550", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:065b643b-8226-58c4-83d1-2ce382d6275c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-14550 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2025-26699", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:f0cc3ead-ab08-5516-aff9-181e92b9b933", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26699 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2025-27556", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:27f170d3-ed56-50e9-935b-fb5e595d9611", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27556 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2025-32873", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:cfe06060-a578-5662-8faf-e291a6842d88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-32873 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2025-48432", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:9a07fb85-7a44-523b-adb3-14c247c777d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48432 is fixed in version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2025-57833", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:4a0838db-3a04-59e9-81e1-cb92dcca36b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-57833 is fixed in version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2025-59681", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:2f18e0fb-de2f-579d-bbe6-c3c6c9c5effa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59681 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2025-59682", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:ac845bce-c03c-57f0-b0b4-3e85e11fbf47", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59682 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2025-64458", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:68635462-1fe8-591b-8938-375e0103c1d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64458 is fixed in version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2025-64459", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:822f8484-d748-56a9-9c8f-d195cdf2863d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64459 is fixed in version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2025-64460", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:97b2d8d4-716c-5f3b-ab5e-ceb7c634cee1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-64460 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2026-1207", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:ec30e989-6c49-558b-a3a4-cb4d47bf53c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1207 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2026-1285", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:e5b29fa1-0bbd-5d65-bad2-deced947b0b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1285 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2026-1287", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:a9a47dac-d6ac-5ccb-89e3-678d2a8257c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1287 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2026-1312", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:a5c3d2c0-5ee5-5fc2-8bf9-346d60e67043", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1312 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2026-15307", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:82301218-b3c3-5373-96fc-0488b6d02a4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-15307 affects version 3.2.25.post8+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare." } }, { "id": "CVE-2026-15830", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:69153e9e-a965-5491-8373-23126561b1f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-15830 affects version 3.2.25.post8+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare." } }, { "id": "CVE-2026-25673", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:65419029-ddf9-543c-a847-2e16e37a1528", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25673 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2026-25674", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:d8a71bc5-2a23-57b8-aa4d-0b4531f604fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25674 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2026-33033", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:85d26d4e-33df-5045-bc28-ee496334ad54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33033 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2026-33034", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:e7015716-7822-50a8-b8d1-73c1c4b296f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33034 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2026-3902", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:801e63cb-0956-5486-b590-49ea8ebb0329", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-3902 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2026-4277", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:e6b1892d-849d-5ced-9f01-6d972dce279d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-4277 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2026-4292", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:b4d01d30-c15c-5d20-9268-0dfe885fd6b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-4292 affects version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2026-48587", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:c4c173ed-4219-5880-bfc0-9d4daa2addfd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-48587 affects version 3.2.25.post8+tuxcare of django, and is fixed in 3.2.25.post10+tuxcare." } }, { "id": "CVE-2026-48588", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:c88ac170-5766-55be-a5fb-411e43148d24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-48588 is fixed in version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2026-53877", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:1defdbaf-505a-5721-8fe9-48229222a155", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53877 is fixed in version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2026-53878", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:44a0cd59-d927-5234-93ba-beba7f7e6473", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-53878 does not affect version 3.2.25.post8+tuxcare of django. not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-6873", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:ed90df96-0d41-5caf-8e30-8b497d3734d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6873 is fixed in version 3.2.25.post8+tuxcare of django." } }, { "id": "CVE-2026-8404", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ], "bom-ref": "urn:uuid:65839dc3-cfa6-56b1-b593-e411e25d4f94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-8404 is fixed in version 3.2.25.post8+tuxcare of django." } } ], "dependencies": [ { "ref": "pkg:pypi/django@3.2.25.post8+tuxcare" } ] }