{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9d6bcac5-6a30-5973-89cb-7cf88f280464", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "django", "purl": "pkg:pypi/django@3.2.25.post9+tuxcare", "type": "library", "bom-ref": "pkg:pypi/django@3.2.25.post9+tuxcare", "version": "3.2.25.post9+tuxcare", "pedigree": { "ancestors": [ { "name": "django", "purl": "pkg:pypi/django@3.2.25", "type": "library", "version": "3.2.25" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-45115", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:aedd0d12-eaf0-5d8d-9697-656d246b4b54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-45115 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2021-45116", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:16fd2307-cc1a-57b4-8249-0a9e0ebc348c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-45116 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2021-45452", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:933bd01b-de57-5a66-babe-a1690c6bedb8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-45452 does not affect version 3.2.25.post9+tuxcare of django. not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(...", "justification": "code_not_present" } }, { "id": "CVE-2022-22818", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:97029297-0f93-5972-a53f-ecf5bb1359b0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22818 does not affect version 3.2.25.post9+tuxcare of django. not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an...", "justification": "code_not_present" } }, { "id": "CVE-2022-23833", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:0d4d5b16-dbb3-52b7-abb6-9b123d55faad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-23833 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2022-28346", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:2742404c-076a-5e6a-9630-d90253edb7a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-28346 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2022-28347", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:64f02827-ac58-5c45-b0e1-5db1caf836f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-28347 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2022-34265", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:cb3f722c-9b4d-5a9d-9783-5f284d5c8f61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-34265 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2022-36359", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:baaee4d3-1bef-5f4b-a5a8-b77b9aa5d428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-36359 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2022-41323", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:7ff648fd-f1e8-54ef-8217-c95bbbf2d2fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-41323 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2023-23969", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:a1eb3939-c24f-5689-8c05-5087f1d37f95", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-23969 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2023-24580", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:582f00b9-92f1-5116-8e87-6d1a3fbf1c98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-24580 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2023-31047", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:2781fec0-f9ab-501f-a2b3-77785dafbdb7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-31047 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2023-36053", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:5d612a63-7bfa-5c91-804a-c2a48e1ea153", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36053 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2023-41164", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:93b6410d-d971-5a07-b52b-677ba0bdef49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41164 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2023-43665", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:1949365b-0e2b-5565-ab13-500bc5970142", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-43665 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2023-46695", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:6bfbb307-c52d-530c-97ea-c4f3cf5219ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46695 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2024-24680", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:30fe6ec3-da44-51b7-803d-9c89f81a0fcf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24680 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2024-27351", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:f39da1db-2344-52ea-b808-bc4a20112b38", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-27351 does not affect version 3.2.25.post9+tuxcare of django. not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b...", "justification": "code_not_present" } }, { "id": "CVE-2024-38875", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:227658cb-e006-538e-a36b-0644fbaa11a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38875 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2024-39329", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:04626dc6-ef1b-518f-ae82-f3505d3b7366", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39329 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2024-39330", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:ce850c5f-d619-5ea2-8915-147f50590774", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39330 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2024-39614", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:f98dcd66-205d-51eb-9d61-71b1698004a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39614 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2024-41989", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:22225f44-8723-57ee-94bd-8c96ba1aa321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-41989 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2024-41990", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:dbcbd87a-3c63-58ca-a1ca-83eb9c540c0e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-41990 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2024-41991", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:fdec2dfb-72f3-5e21-89cc-fd4b4a4b9383", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-41991 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2024-42005", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:49725dba-f9ea-5ec6-b423-6de4bd062f5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-42005 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2024-45230", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:ce603925-34a5-5301-9dca-022bfb7fdbe2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45230 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2024-45231", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:6f42a977-a98e-5a88-add8-fd562defc43e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45231 is fixed in version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2024-53907", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:1c4364f2-9a47-5e95-946d-82b68b10c41d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-53907 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2024-53908", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:077b8e9b-e829-543b-b8a5-58f697a708c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-53908 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2024-56374", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:4969de1e-9206-5071-8f59-193c7b4890c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56374 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2025-13372", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:8bccc908-45a7-511a-b3a5-39dd74acc23e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-13372 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2025-13473", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:cb97cac9-743d-5c54-9a59-aa639ee15927", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-13473 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2025-14550", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:50777442-76b7-58f6-9ad9-5fd22472fb3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-14550 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2025-26699", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:0b387a09-f480-5abf-b32e-516892874acb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26699 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2025-27556", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:fcb5050b-f2c6-5066-8438-f0955bc69f01", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27556 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2025-32873", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:07354594-6397-5ed2-871e-1601132ef015", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-32873 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2025-48432", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:786ad2be-5765-50aa-8507-5402004dc371", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48432 is fixed in version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2025-57833", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:2af075c6-abd5-5d0e-89a5-0a5c313d1161", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-57833 is fixed in version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2025-59681", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:20ff6a1c-c420-5b60-b96d-46952d77c8b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59681 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2025-59682", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:2f00d4ab-f101-54ce-be86-c6a72c65b3ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59682 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2025-64458", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:9224d162-ab64-5a91-b5fd-7118583384eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64458 is fixed in version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2025-64459", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:855bc88f-0227-544d-be1a-d5d652e59491", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64459 is fixed in version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2025-64460", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:9584c39a-ba5a-5fc3-81ca-8b0bc03a0233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-64460 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2026-1207", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:da412ebc-1210-53a9-9b6f-68b646b3f300", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1207 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2026-1285", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:b6a5c0ff-0290-52c0-961b-3f8c48f7af59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1285 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2026-1287", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:ce086780-6319-5eb9-b883-bf855825accf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1287 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2026-1312", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:32ddd8df-d06d-55b5-839c-2f7c1971e0ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1312 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2026-15307", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:3cb0af2e-b1cb-588f-b134-5bb4058dead2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-15307 is fixed in version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2026-15830", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:b924dca1-779c-583e-aed0-003de222003f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-15830 is fixed in version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2026-25673", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:96145c69-0d53-57b3-a141-df8b27de4600", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25673 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2026-25674", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:2677457e-8fe6-5224-933e-2d2a455b8d6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25674 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2026-33033", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:4cc63456-52ef-5b6f-b6c6-93c8bb35051b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33033 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2026-33034", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:e935a27a-29bf-57fe-8e44-0a330955e13f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33034 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2026-3902", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:416d6d1e-fdf5-567e-9216-c0a6bb294d5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-3902 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2026-4277", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:5fb6dcb7-f2e7-554c-8fc3-82c1bcbcdb83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-4277 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2026-4292", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:06004851-9012-5067-9dec-9a6fe67ba1df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-4292 affects version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2026-48587", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:13f29c8e-7362-531d-bc82-d64bae81a801", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-48587 affects version 3.2.25.post9+tuxcare of django, and is fixed in 3.2.25.post10+tuxcare." } }, { "id": "CVE-2026-48588", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:588397c5-0eb2-571d-9128-088f77b48235", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-48588 is fixed in version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2026-53877", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:13bbf5be-e71a-5afd-9e8c-015e7cdfde7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53877 is fixed in version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2026-53878", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:6f4e309d-1b18-54cf-b5be-9543d8338ea3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-53878 does not affect version 3.2.25.post9+tuxcare of django. not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-6873", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:20e0a660-4a04-5139-9031-7ed7ef4e6590", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6873 is fixed in version 3.2.25.post9+tuxcare of django." } }, { "id": "CVE-2026-8404", "affects": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ], "bom-ref": "urn:uuid:37e7317c-2890-585f-b989-71ecbe612880", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-8404 is fixed in version 3.2.25.post9+tuxcare of django." } } ], "dependencies": [ { "ref": "pkg:pypi/django@3.2.25.post9+tuxcare" } ] }