{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f5da6c30-8cd8-56e4-aed7-848ea2e2c02c",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "django",
      "purl": "pkg:pypi/django@5.1.10.post6+tuxcare",
      "type": "library",
      "bom-ref": "pkg:pypi/django@5.1.10.post6+tuxcare",
      "version": "5.1.10.post6+tuxcare",
      "pedigree": {
        "ancestors": [
          {
            "name": "django",
            "purl": "pkg:pypi/django@5.1.10",
            "type": "library",
            "version": "5.1.10"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-45115",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:892650e3-0523-57fc-8073-f6122a8e63fc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-45115 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2021-45116",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:5704600d-9d0e-550d-8b76-648ff32867f8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-45116 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2021-45452",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:be56a866-b953-53fd-84c8-50e3f86c1fe3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-45452 does not affect version 5.1.10.post6+tuxcare of django. not_affected \u2014 CVE-2021-45452 directory traversal vulnerability in Django Storage.save() is NOT present in the target. The security fix was introduced by upstream Django in December 2021 (commit 6d343d01c5) and shipped with Django 4.0.1, 3.2.11, and 2.2.26. Since the target is Django 5.1.10 (released in 2025), this fix has been part of the upstream codebase for years. All defense mechanisms are present and ac...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22818",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:cdd0223f-d383-5e7e-af14-37303b34671c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22818 does not affect version 5.1.10.post6+tuxcare of django. not_affected \u2014 CVE-2022-22818 is not present in Django 5.1.10.post7+tuxcare. The vulnerability (unescaped HTML output in the {% debug %} template tag) was fixed by upstream Django in commit 394517f078 on 2022-01-02, over 4 years before TuxCare began maintaining this version. The target's DebugNode class contains all the security controls from the patch: HTML-escaping via escape() for both context values and s...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-23833",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:562580b4-edab-5e18-af1a-f9916b805b33",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-23833 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2022-28346",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:a38f38fa-765d-52fa-8fbd-cb4b2333a8a0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-28346 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2022-28347",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:c38d0315-68fc-5584-b565-93a4e4098369",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-28347 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2022-34265",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:25e71e21-4cab-58b7-8b5a-d037fb223922",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-34265 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2022-36359",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:893acc07-c3d2-560f-9f96-d3e67ed0d34b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-36359 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2022-41323",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:4a9104ec-131d-5a76-8fe0-78e6c40ced23",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-41323 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2023-23969",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:82509e25-bc76-5236-ac9d-f66cb17eb663",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-23969 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2023-24580",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:56724b1a-9819-5b9e-b857-8416197b7572",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-24580 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2023-31047",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:784be26f-e4a7-5390-a4f8-d41e37539773",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-31047 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2023-36053",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:586b1bb7-f2ae-5f78-8db0-ae70bdc78739",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-36053 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2023-41164",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:8c2481ef-4485-5644-9cd7-fcda0ed54471",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-41164 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2023-43665",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:45271580-49f1-54c2-8587-5ffbfbd8bb7e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-43665 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2023-46695",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:9f9dbc2d-b49e-53fb-98cc-f4c62e7b8bbf",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-46695 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2024-24680",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:ce053190-1208-555d-a0a8-1944cd4607a5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-24680 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2024-27351",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:d7f5f3a3-d32b-551c-b84e-a9da320e1ce9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-27351 does not affect version 5.1.10.post6+tuxcare of django. not_affected \u2014 Django 5.1.10 is not affected by CVE-2024-27351. The vulnerable regex pattern (r\"<[^>]+?>|([^<>\\s]+)\") that caused catastrophic backtracking was completely eliminated by an upstream architectural refactoring in Django 5.1. Commit 6ee37ada32 (Jan 2023) replaced the regex-based HTML truncation with Python's HTMLParser, and commit 3cadeea077 (Feb 2024) removed the now-unused vulnerable regex. Both...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38875",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:db2e8866-fe53-5240-a1bd-5bf1e3de6636",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38875 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2024-39329",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:231dfc95-26e2-57cd-aa78-4c2b6d719460",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-39329 does not affect version 5.1.10.post6+tuxcare of django. not_affected \u2014 CVE-2024-39329 (timing attack for user enumeration via unusable passwords) is NOT present in Django 5.1.10. The vulnerability was fixed by upstream Django in commit f5d16483f3, which shipped in the upstream 5.1 release before TuxCare onboarding. The fix adds a standardized hashing operation (fake_runtime) in verify_password() to normalize response times when password checks short-circuit, preve...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-39330",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:fc3dc48f-ec8c-572d-b832-867f5c2a71a3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-39330 does not affect version 5.1.10.post6+tuxcare of django. not_affected \u2014 CVE-2024-39330 does not affect Django 5.1.10. The fix for this directory traversal vulnerability was already present in the upstream Django 5.1.x release. The target repository at commit 9bce7312cd (version 5.1.10.post7+tuxcare) contains the complete fix: three validate_file_name() calls in Storage.save() method and backslash normalization in the validation function. This fix was authored by up...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-39614",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:34a21f26-669a-5ceb-85aa-70914d3874bd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-39614 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2024-41989",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:4ce2fe76-9305-578e-8e30-119ea924bb72",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-41989 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2024-41990",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:81201206-1954-5022-b740-65b92e4ae541",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-41990 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2024-41991",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:a6be2af6-dbaf-55a1-b339-ac00740281c0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-41991 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2024-42005",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:7bd8c2e1-6ff0-525a-9dd7-5f0f6efc9780",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-42005 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2024-45230",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:87b114d8-c933-55e3-8c09-50cb020b531e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-45230 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2024-45231",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:137bd31f-cfe0-52a5-9c96-55bc94e63fea",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-45231 does not affect version 5.1.10.post6+tuxcare of django. not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.10. The vulnerability (email enumeration via unhandled exceptions during password reset) was fixed by upstream Django in commit 3c733c78d6 before TuxCare onboarded the 5.1.x release. The fix wraps email_message.send() in exception handling at django/contrib/auth/forms.py:430-435, preventing email sending failures from propagating as distinguishable 50...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-53907",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:70a28899-aa23-5113-ae63-45510d3fbd48",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-53907 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2024-53908",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:4b27cf37-2bf3-55b6-bcd5-b0dbc641d815",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-53908 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2024-56374",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:f11ed761-96bf-519e-afe1-cc39a602342c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-56374 does not affect version 5.1.10.post6+tuxcare of django. not_affected \u2014 Django 5.1.10.post7+tuxcare is not affected by CVE-2024-56374. The upstream fix (commit 4806731e58) was already included in the upstream Django 5.1.x release that TuxCare onboarded. The fix adds a 39-character length limit before IPv6 parsing, preventing denial-of-service attacks through excessively long IPv6 address strings. All three affected files (django/utils/ipv6.py, django/forms/fields.p...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-13372",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:a93b732b-aa9a-5ddf-8faf-6b53d055a87c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-13372 is fixed in version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2025-13473",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:7b689e7b-2fe0-59b3-888f-20350e8e561a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-13473 is fixed in version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2025-14550",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:023eb027-a92b-5fbf-8b26-95c2e2dbf891",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-14550 is fixed in version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2025-26699",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:6465f119-d16a-5111-8b8d-c7f69af6961b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-26699 does not affect version 5.1.10.post6+tuxcare of django. not_affected \u2014 The target Django 5.1.10.post7+tuxcare is not affected by CVE-2025-26699. The vulnerable nested-loop implementation in django.utils.text.wrap() has been replaced with Python's standard textwrap.TextWrapper module. This fix was authored by upstream Django (Sarah Boyce) and shipped in the upstream release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable code pattern is n...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-27556",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:a2618969-f7ba-5753-b9c1-c805b549f446",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-27556 does not affect version 5.1.10.post6+tuxcare of django. not_affected \u2014 CVE-2025-27556 does not affect this Django 5.1.10.post7+tuxcare version because the upstream fix was already present in the Django 5.1.x release before TuxCare started maintaining this branch. The fix (commit edc2716d01) adds a MAX_URL_LENGTH check that rejects URLs exceeding 2048 characters before they reach urlparse, preventing CPU exhaustion from Unicode normalization. All three affected end...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-32873",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:fd27d28c-b95b-55b7-bb9c-2227db2733a3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-32873 does not affect version 5.1.10.post6+tuxcare of django. not_affected \u2014 Django 5.1.10 is not affected by CVE-2025-32873. The vulnerability affects Django 5.1 before 5.1.9, but this target is version 5.1.10. The fix for this DoS vulnerability in strip_tags() was already present in the upstream Django 5.1.9 release that TuxCare onboarded. The defensive regex pattern (long_open_tag_without_closing_re) and validation check are present in django/utils/html.py at lines 4...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-48432",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:682c96ec-3cea-53c9-a334-a3e1c86da0fb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-48432 does not affect version 5.1.10.post6+tuxcare of django. not_affected \u2014 The target Django 5.1.10.post7+tuxcare already contains the CVE-2025-48432 fix. The core fix (unicode_escape encoding of logging arguments) was shipped in the upstream Django 5.1.10 release, authored by Natalia from the Django core team. The vulnerable pattern (unescaped request.path in logs allowing control character injection) is not present.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-57833",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:1c6affb6-9b86-51bc-840f-185ba86a4206",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-57833 is fixed in version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2025-59681",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:dbbf69ca-e4c9-5d69-be95-1e9092775e3d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-59681 is fixed in version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2025-59682",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:86097d78-326e-59f9-92b7-10e5dad9d3a2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-59682 is fixed in version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2025-64458",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:d4cf547a-1811-56f5-864d-fb366b37bede",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-64458 is fixed in version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2025-64459",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:65808a54-3fce-5590-a38e-bec4bdf911f4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-64459 is fixed in version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2025-64460",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:5f59d6c7-0977-5f6a-b7be-698503949182",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-64460 is fixed in version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-1207",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:0575c284-46a3-5575-a714-1349864359d2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-1207 is fixed in version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-1285",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:947342be-2770-5a6d-8cec-d9d49b6f492a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-1285 is fixed in version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-1287",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:1ba2690d-ce2f-56cf-99ff-4ebe612fbbf2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-1287 is fixed in version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-1312",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:95e21bb0-9e7b-5887-b55d-3e970b825305",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-1312 is fixed in version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-15307",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:505689fb-af05-50d6-9455-f8bcea1f228a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-15307 is fixed in version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-15830",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:e80a36df-da8b-5e7b-8f0a-5d967773b656",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-15830 is fixed in version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-25673",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:01f748ab-796f-52c7-95dc-e5396dc14e9b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-25673 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-25674",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:31d5d1c4-2b6e-5552-8a71-a30ef57230e7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-25674 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-33033",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:9f468cf0-568f-5508-a392-adfe100b3782",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-33033 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-33034",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:40eba20a-6f1d-5735-a3d6-1eaaa8f3e992",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-33034 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-3902",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:c94b013b-6529-59fd-aae6-5dbeef34eebf",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-3902 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-4277",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:bdcfc26a-3e4b-50a8-9dd1-c154fe1a4f31",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-4277 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-4292",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:10bb2f42-0969-5d07-b8e8-8676345cf59b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-4292 affects version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-48587",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:38b9ca1d-c792-5908-89d0-3bfdf37a4d0a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-48587 is fixed in version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-48588",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:d3b690a4-d256-50ef-a054-8f28f264293a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-48588 is fixed in version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-53877",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:c23db551-a37f-54c1-b1d2-499d6d81d03b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-53877 is fixed in version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-53878",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:8cacb046-3654-5d54-9688-5ff5ce69d94e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53878 affects version 5.1.10.post6+tuxcare of django, and is fixed in 5.1.10.post7+tuxcare."
      }
    },
    {
      "id": "CVE-2026-6873",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:10129758-bd01-566e-a9e6-70bfd8800c68",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-6873 is fixed in version 5.1.10.post6+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-8404",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:78c2f0db-833f-5121-bc67-a6b12f2fdbbe",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-8404 is fixed in version 5.1.10.post6+tuxcare of django."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:pypi/django@5.1.10.post6+tuxcare"
    }
  ]
}