{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0a1398c5-3e4d-5bcd-9056-c633c15e5a6b",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "django",
      "purl": "pkg:pypi/django@5.1.9.post8+tuxcare",
      "type": "library",
      "bom-ref": "pkg:pypi/django@5.1.9.post8+tuxcare",
      "version": "5.1.9.post8+tuxcare",
      "pedigree": {
        "ancestors": [
          {
            "name": "django",
            "purl": "pkg:pypi/django@5.1.9",
            "type": "library",
            "version": "5.1.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-45115",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:b56eb787-f743-5baf-9586-605b0d5960f0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-45115 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2021-45116",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:b1a38350-be9f-51ba-b0db-08cb10b4cee8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-45116 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2021-45452",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:f4c50c68-4266-5295-b5af-cadf17243f91",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-45452 does not affect version 5.1.9.post8+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2021-45452. All four security defenses from the December 2021 upstream fix are present in the target: (1) post-save validation via validate_file_name(), (2) backslash normalization in get_available_name(), (3) backslash normalization in generate_filename(), and (4) os.path.relpath() in FileSystemStorage._save() ensuring paths remain relative to storage root. ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22818",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:6d3202f1-ef08-5e4a-b97a-b9bf273a8c9e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22818 does not affect version 5.1.9.post8+tuxcare of django. not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2022-22818 (XSS via {% debug %} template tag). The upstream fix from commit 394517f078 (2022-01-02) is present in the target. The DebugNode.render() method at django/template/defaulttags.py:120-130 includes all three defensive measures: (1) early return when settings.DEBUG is False (line 122-123), (2) HTML-escaping context values via escape(pformat(val)) (lin...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-23833",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:4abcbdc8-3009-5c5b-8430-833554e25076",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-23833 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2022-28346",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:2079f690-57b7-5b61-a31d-45e538110517",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-28346 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2022-28347",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:58250972-7268-5629-ab2c-5dfa68de3f33",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-28347 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2022-34265",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:5828e08c-ede1-568d-b29e-5fa68308290d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-34265 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2022-36359",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:35657d92-624b-5f5f-b3cc-f6faa47b31e9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-36359 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2022-41323",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:814a2813-edf6-5fac-8ab8-055a9596cd21",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-41323 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2023-23969",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:ead45982-5469-5bcd-89a1-f289de5bf7e1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-23969 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2023-24580",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:ac621fa9-dc9d-5a2c-a6ea-f7a35e410a24",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-24580 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2023-31047",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:5da411e5-1327-5265-88c4-b04590966ab4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-31047 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2023-36053",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:cc458993-aca3-50bb-a100-705bb6db9b1f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-36053 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2023-41164",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:a8130a76-ff55-5e39-a69e-d0b936f02e70",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-41164 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2023-43665",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:4d5518b8-fadc-549a-8051-70ae3291a5f1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-43665 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2023-46695",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:458c1bbb-251e-565f-b102-90dca856a6cb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-46695 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2024-24680",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:4e8d6eeb-1b88-5c75-aef8-67807a3c2a96",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-24680 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2024-27351",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:26991e32-3088-5af9-8958-ea5943fb1283",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-27351 does not affect version 5.1.9.post8+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-27351 because it uses a completely different architecture (HTMLParser-based) introduced in upstream commit 6ee37ada32 (January 2023). The vulnerable regex pattern `<[^>]+?>|([^<>\\s]+)` that causes catastrophic backtracking is not present in the codebase. The Truncator.words(html=True) method uses TruncateWordsHTMLParser which leverages Python's standard ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38875",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:bfcd66ec-f64c-55b8-8925-16b0e213b484",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38875 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2024-39329",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:8f7b6b89-1493-5122-9dd6-6b729f683ab3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-39329 does not affect version 5.1.9.post8+tuxcare of django. not_affected \u2014 CVE-2024-39329 is not present in Django 5.1.9. The upstream fix (commit f5d16483f3) was already included in the Django 5.1.x release branch before TuxCare onboarded this version. The fix standardizes timing in verify_password() by executing password hashing operations even for unusable passwords, preventing user enumeration via timing attacks. The vulnerable pattern (immediate return without ha...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-39330",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:693d832e-478a-50b5-966a-91fd9744a58d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-39330 does not affect version 5.1.9.post8+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-39330. The vulnerability pattern (directory traversal via Storage.save() when subclasses override generate_filename() without validation) is not present in this version. The fix was already included in the upstream Django 5.1.x release before TuxCare's maintenance began. Commit 6d36203648a by upstream Django developer Natalia (124304+nessita@users.norepl...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-39614",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:9bff9d6e-c799-5270-8254-6c3804cb09de",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-39614 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2024-41989",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:078116bc-da9d-509c-b50b-e500fbe53daf",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-41989 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2024-41990",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:e6f2841d-a86e-5f45-96f9-8b2d78e24b01",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-41990 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2024-41991",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:8de2fff3-3a2a-5fea-b525-5a619d80cac4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-41991 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2024-42005",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:6f62f369-aab6-500d-bae2-4fcb7ca5cb28",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-42005 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2024-45230",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:87c92be1-bfb2-5cac-8949-60e5caf56427",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-45230 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2024-45231",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:3d950594-c2cd-5eb9-9770-02ea377901fc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-45231 does not affect version 5.1.9.post8+tuxcare of django. not_affected \u2014 The target Django 5.1.9 is not affected by CVE-2024-45231. The vulnerability (user email enumeration via unhandled exceptions during password reset) was fixed in upstream Django 5.1.1, and the target version 5.1.9 inherited this fix from upstream. The defense code (try-except block catching exceptions in PasswordResetForm.send_mail) is present at django/contrib/auth/forms.py lines 430-435. The ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-53907",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:60d98498-09e2-5dfe-988f-34f47f31dce8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-53907 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2024-53908",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:8582be8b-2140-53c0-958c-52b3a80b30c9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-53908 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2024-56374",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:2fc67f4c-67e4-5d7e-9a04-8cc5614c30b7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-56374 does not affect version 5.1.9.post8+tuxcare of django. not_affected \u2014 The target Django 5.1.9.post9+tuxcare contains the complete fix for CVE-2024-56374. The upstream fix (commit 4806731e58 by mike@manfre.net) was already included in the Django 5.1.9 release before TuxCare began maintaining this version. The fix adds length validation (MAX_IPV6_ADDRESS_LENGTH=39) to IPv6 validation functions via _ipv6_address_from_str(), preventing DoS attacks via excessively lon...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-13372",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:a7c16bc5-78da-53c6-a5a1-0ab6543652bd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-13372 is fixed in version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2025-13473",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:e49e35d5-5a60-52e5-a661-48bf0b4d22e3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-13473 is fixed in version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2025-14550",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:2ce57279-dc5c-59f7-9d1f-e933b78e83da",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-14550 is fixed in version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2025-26699",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:642c1dc8-6f32-5fd3-88d7-ae22046e0eab",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-26699 does not affect version 5.1.9.post8+tuxcare of django. not_affected \u2014 Target Django 5.1.9 is not affected by CVE-2025-26699. The vulnerability existed in the custom string-wrapping implementation that used an inefficient _generator() function, which could cause DoS with very long strings. However, this vulnerable code pattern is not present in the target. The fix (commit 8dbb44d3) replacing the custom implementation with Python's optimized textwrap.TextWrapper wa...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-27556",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:c22ab89b-24d6-5286-af56-16b7ae8cb619",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-27556 does not affect version 5.1.9.post8+tuxcare of django. not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2025-27556. The vulnerability, a DoS attack via slow Unicode normalization in URL processing, was fixed in the upstream Django 5.1.9 release before TuxCare onboarded this version. The fix (commit edc2716d01a) adds a MAX_URL_LENGTH check (2048 bytes) to reject excessively long URLs before they reach the expensive urlparse/normalization operations. This fix was...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-32873",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:3a43afd5-60c8-56ba-9c0b-66d83a0d8b34",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-32873 does not affect version 5.1.9.post8+tuxcare of django. not_affected \u2014 Django 5.1.9.post9+tuxcare is not affected by CVE-2025-32873. The upstream fix for the DoS vulnerability in strip_tags() was already present in Django 5.1.9 (released April 8, 2025) which TuxCare onboarded. The fix adds pre-validation checks to detect and reject inputs with large sequences of incomplete HTML tags before the expensive stripping operation, raising SuspiciousOperation when malicio...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-48432",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:3c33a530-ce91-5820-a1de-3f10648458a6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-48432 is fixed in version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2025-57833",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:7b0bd884-90ca-561a-9301-3c0fb9a9e9f5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-57833 is fixed in version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2025-59681",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:6c3ad724-9cc9-5df6-af69-1199c2a2921e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-59681 is fixed in version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2025-59682",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:70f6bbc7-bf97-5711-b5fa-3d546927a544",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-59682 is fixed in version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2025-64458",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:32a1688b-1a53-589b-a875-c9974123c802",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-64458 is fixed in version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2025-64459",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:6d7f48b0-9d77-52dc-a680-b971996b781c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-64459 is fixed in version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2025-64460",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:9641240f-7278-5e57-92ff-9a7a120cbe3d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-64460 is fixed in version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-1207",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:bc4d9ef7-68e5-595c-b06d-9c268b42432d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-1207 is fixed in version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-1285",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:074247c3-183d-5a17-9130-7d466b3e0055",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-1285 is fixed in version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-1287",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:e2c6750a-dd6c-57c3-b651-ed946a61f3b9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-1287 is fixed in version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-1312",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:956bfacf-634d-5c3c-bb16-064625e2737b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-1312 is fixed in version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-15307",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:c3033976-d894-56f0-8574-f954e6605b13",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-15307 is fixed in version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-15830",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:7b2e7e4e-824e-518c-a4d6-670d2365bb19",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-15830 is fixed in version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-25673",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:1c711693-4cc2-504d-a4ce-1ab86013bddc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-25673 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-25674",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:14d4d5b0-3aee-522d-a4ed-943327b23b42",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-25674 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-33033",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:32302810-b1a6-5740-89b0-f65fd0d8eefc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-33033 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-33034",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:32d00a37-5268-586c-922c-d5d2997b184d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-33034 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-3902",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:9bc66c41-c62f-5147-9085-5467945e3519",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-3902 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-4277",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:301f591e-332b-5a07-a5e8-9b1feb159fa6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-4277 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-4292",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:ecd87ed2-92d2-590b-b343-f8beba2c1a1f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-4292 affects version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-48587",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:2c3770b1-85cf-51cf-a4d7-ba039be8f185",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-48587 is fixed in version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-48588",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:b008a6b8-fae0-5a79-a9c3-327085de513c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-48588 is fixed in version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-53877",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:802203c4-e475-5acf-9a65-16d7df4f4226",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-53877 is fixed in version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-53878",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:5e44dceb-7b6f-580b-8e78-4a7a503e42c4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-53878 is fixed in version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-6873",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:9ea57f74-b985-5e57-94dc-9fa75a09eee7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-6873 is fixed in version 5.1.9.post8+tuxcare of django."
      }
    },
    {
      "id": "CVE-2026-8404",
      "affects": [
        {
          "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:314b5248-0df9-5e8f-8591-24c87e3179e0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-8404 is fixed in version 5.1.9.post8+tuxcare of django."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:pypi/django@5.1.9.post8+tuxcare"
    }
  ]
}