{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ffaecb58-4845-5f95-8269-6774774dc4fd",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "pillow",
      "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare",
      "type": "library",
      "bom-ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare",
      "version": "11.2.1.post8+tuxcare",
      "pedigree": {
        "ancestors": [
          {
            "name": "pillow",
            "purl": "pkg:pypi/pillow@11.2.1",
            "type": "library",
            "version": "11.2.1"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-22815",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:65f11be1-556d-579f-8325-af6422b836ac",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22815 does not affect version 11.2.1.post8+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22816",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:cc5baef4-4413-57ce-9e7d-f474ef528dae",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22816 does not affect version 11.2.1.post8+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22817",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:d7512696-7b0e-5a26-88d0-a36f2a505c33",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22817 affects version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2022-24303",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:d4296b45-d78b-59a1-ba78-8e2596e85a7f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-24303 affects version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2022-45198",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:4c767bb0-88c0-5e9c-be30-5c166388633b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-45198 affects version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2023-44271",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:d95d9aff-0fe1-576c-a8a4-65fab11b048f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-44271 affects version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2023-4863",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:4dbccb4b-a006-574f-9935-048d49539156",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-4863 affects version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2023-50447",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:3185cbe0-39dd-51cc-b97a-63c9b21965b3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-50447 affects version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2024-28219",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:42e5c553-2111-51e1-b4b0-ec453f227b8f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-28219 does not affect version 11.2.1.post8+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-48379",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:fcb2582b-f287-5001-8169-f299e41ebd38",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-48379 is fixed in version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-112390",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:c0ec54fc-10bf-5202-95f0-1a1ac3b1f91f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112390 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112391",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:e1aa5343-7ab7-5801-8d2f-b2ab5a5c567c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112391 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112392",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:447897a0-431e-51ef-91e1-208e156b843b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112392 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112393",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:eb91d539-57cf-5627-a693-f0a5dea25240",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112393 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112394",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:8b519228-4cb8-58bf-b830-839dede73956",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112394 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112395",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:bde2d5b3-a557-530b-aa61-4c7c8e36a9f8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112395 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112396",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:4b16d56d-1591-5d1a-9c44-89187d466384",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112396 affects version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-112397",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:ac38314f-9279-5d7e-852c-fb4370e5cc67",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112397 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112398",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:e69290fc-169b-5a62-911d-f92179dca2d7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112398 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112399",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:25507f9a-3c1b-5d06-95fa-0bc818a1c13c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112399 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112400",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:435d0fd8-5b9a-5448-ae01-4044730cae5b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112400 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112401",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:8323cff4-b841-5f55-aaa8-33b038c65d95",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112401 affects version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-112402",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:bdf43dcf-253f-53db-bba3-6cd5f301dc97",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112402 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112403",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:8f2d0f17-fec8-5c80-8092-d741450a3cc6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112403 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112404",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:d2565eae-c98a-597c-b53a-8d7236842a09",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112404 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112405",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:7ab2e25c-334f-5f6d-bcc9-a4b2e5feca15",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112405 affects version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-112406",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:af9f4bcb-a4e1-5191-8dc8-868053de6fda",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112406 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112891",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:e5b92283-c99d-5abd-9186-f36faac254a8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112891 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112892",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:7fa1180a-3d9b-5d6b-a700-727240a87994",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112892 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112893",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:6575ec0d-ebe9-586a-a818-fe7b361bd637",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112893 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112894",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:af1cfce3-f891-53c9-84da-3ebe2e75f055",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112894 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112895",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:34acb50d-509f-598a-ae03-d3f0db0d3625",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112895 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112896",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:2d23a85f-e1bc-5bd2-aca0-a72390d9e56b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112896 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112897",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:c1ca576c-b30e-53c2-8f74-938697806839",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112897 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112898",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:f298578f-052b-5ef7-ba0f-3e8315769311",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112898 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112899",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:2937eafb-2222-5b3a-a637-cde26903628e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112899 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112900",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:02423c5f-da84-5634-995f-e6593d67161d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112900 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112901",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:9db01a2e-9f3a-5d8c-a98f-c5bdd484c148",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112901 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112902",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:f7e01c7e-47c3-5a92-a778-27142fbe4b73",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112902 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare."
      }
    },
    {
      "id": "CVE-2026-114501",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:1fad75f6-fc8e-54b0-86eb-49d514b25518",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-114501 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare."
      }
    },
    {
      "id": "CVE-2026-25990",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:1f5fc3e4-1290-504b-8464-558da7679c38",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-25990 is fixed in version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-40192",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:a4140cbc-1163-5c74-ba7d-41f960c64846",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-40192 is fixed in version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-42308",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:223780d9-6855-5ef9-b95b-34b63199fca4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42308 is fixed in version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-42309",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:f2aa5a6c-1648-5439-9855-b4d0c7bef6a4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42309 is fixed in version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-42310",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:ce5f3a2f-22f2-5fb3-9860-56cc3dfcd08f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42310 is fixed in version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-42311",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:97ed8d0e-7e27-583a-a664-cde1bf90b45a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42311 is fixed in version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-54058",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:81f29497-fc44-5515-a67b-c7ccbd844d3a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54058 is fixed in version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-54059",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:ac2fc4c2-5990-5bfb-8e61-2fbb5756008c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54059 is fixed in version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-54060",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:115504f1-ced8-5d39-85cd-74d6501276ba",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54060 is fixed in version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-55379",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:29eeb24c-a9a6-5499-b4fe-7d677be470bb",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-55379 is fixed in version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-55380",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:0224ab13-ef67-50c3-b662-1681ce7fc407",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-55380 is fixed in version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-55798",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:4dfa4795-82be-59a8-9780-41526dec86d0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-55798 is fixed in version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-59197",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:1880486b-b0d6-5477-bc14-3a588e7a620b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59197 is fixed in version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-59198",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:8aa2e9d5-b5a1-52e6-942e-910db2442277",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59198 is fixed in version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-59199",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:406c1d62-02b2-572b-aab9-38c5e557c5eb",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59199 is fixed in version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-59200",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:01da09b6-a9a4-560e-b918-9fea1be36072",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59200 is fixed in version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-59204",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:1e50d566-4edc-5e64-8ee5-bc1c6a434924",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59204 is fixed in version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-59205",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:fe0f6dd5-7c01-5598-85d1-4f671665de4b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59205 is fixed in version 11.2.1.post8+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-96636",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:8d0bf889-861a-5519-a906-93f72efdd8ba",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-96636 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare."
      }
    },
    {
      "id": "CVE-2026-96637",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:ea212ed1-c712-50c3-a402-9ca4991f57e0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-96637 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare."
      }
    },
    {
      "id": "CVE-2026-96638",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:c26cfea6-dae2-5841-b4db-290bf816a264",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-96638 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare."
      }
    },
    {
      "id": "CVE-2026-96639",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:60de6f59-c8fe-5021-9d3f-812a6dffec45",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-96639 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare."
      }
    },
    {
      "id": "CVE-2026-96640",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:f78a1db2-e3a8-584f-b66f-5f0a6b82a588",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-96640 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare."
      }
    },
    {
      "id": "CVE-2026-96641",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:1cd357eb-f103-5e7b-95a9-97bc80f52b05",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-96641 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare."
      }
    },
    {
      "id": "CVE-2026-96642",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:a2478e23-d541-5dd3-adc6-4682cb8088cb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-96642 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare."
      }
    },
    {
      "id": "CVE-2026-96643",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:2e056680-224f-50fa-93e6-72e82a3bfe82",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-96643 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare."
      }
    },
    {
      "id": "CVE-2026-96644",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:ddd86b96-d32a-582e-b57b-472042afcc70",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-96644 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare."
      }
    },
    {
      "id": "CVE-2026-96778",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:8df57756-94b2-5380-bcf4-4b370b9a14bf",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-96778 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare."
      }
    },
    {
      "id": "GHSA-4fx9-vc88-q2xc",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:62446b75-30e3-50dd-b932-7bf08ff3ca66",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.2.1.post8+tuxcare of pillow. not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-78g4-xqwv-q3g8",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:e338e3df-824d-5d3a-bb17-e331e30c0e58",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.2.1.post8+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository...",
        "justification": "requires_dependency"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:pypi/pillow@11.2.1.post8+tuxcare"
    }
  ]
}