{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f30ab9a4-3c15-5e72-9003-461ed83175a8",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "pillow",
      "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare",
      "type": "library",
      "bom-ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare",
      "version": "11.3.0.post6+tuxcare",
      "pedigree": {
        "ancestors": [
          {
            "name": "pillow",
            "purl": "pkg:pypi/pillow@11.3.0",
            "type": "library",
            "version": "11.3.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-22815",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:03391e84-a89a-5b3d-b0a7-667dba310d44",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22815 does not affect version 11.3.0.post6+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target repository (Pillow 11.3.0.post12+tuxcare) already contains the upstream fixes (commits 1e092419b and c48271ab3) that were released in Pillow 9.0.0 on 2022-01-02. The vulnerable code patterns (malloc instead of calloc, missing count==0 check) are not present in the target. The fixes were authore...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22816",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:e24265f1-1b6a-525b-830e-7dd190b2ff46",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22816 does not affect version 11.3.0.post6+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0. The target is Pillow 11.3.0.post12+tuxcare, which contains upstream fixes that prevent the buffer over-read vulnerability. Both required fixes are present: (1) calloc initialization at src/path.c:61 replaces malloc to zero-initialize memory, and (2) bounds check at src/path.c:359-362 prevents accessing xy[0] and xy[1] when count is 0. These fixes were...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22817",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:c5bb3bdf-5c43-5631-84d8-e8d68ec0372b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22817 affects version 11.3.0.post6+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2022-24303",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:4f5d8641-cfd8-55ca-9b86-bdabdf31c597",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-24303 affects version 11.3.0.post6+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2022-45198",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:3ccfb1c5-1e1c-561b-989d-8c6cb40be50d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-45198 affects version 11.3.0.post6+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2023-44271",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:7315e119-cd98-595f-8ddc-ab91e052fb55",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-44271 affects version 11.3.0.post6+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2023-4863",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:603b3547-50e5-51e2-936b-c3594a4dd14d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-4863 affects version 11.3.0.post6+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2023-50447",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:a3b91512-7788-5db6-9592-43c2f77a1955",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-50447 affects version 11.3.0.post6+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2024-28219",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:ea5f27dd-df76-5c82-af52-1c9e388dfc30",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-28219 does not affect version 11.3.0.post6+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 is NOT present in the target repository at version 11.3.0 (SHA 388e73f2e). The vulnerability involved buffer overflow via strcpy() in src/_imagingcms.c when copying mode strings into fixed-size buffers. The upstream fix (commit 2a93aba5c by Andrew Murray, merged April 1, 2024) replaced strcpy with strncpy, and this fix was already present in the upstream release before TuxCare's ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-48379",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:cfda687d-b56b-515f-a532-2e962f73861c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-48379 affects version 11.3.0.post6+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-112390",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:a5235d4b-5efe-5b1c-bb1c-94b93e4c12b0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112390 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112391",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:99bd5f34-a211-595b-8593-9e00f16503e1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112391 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112392",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:7954f01b-d504-5366-b5b0-3642226b9915",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112392 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112393",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:ee8f0634-c03c-5d10-a245-cca4c04cc215",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112393 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112394",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:17af830b-7a81-5026-bffd-41da163517bb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112394 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112395",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:24701cbc-117a-5a85-b2b2-e91c69602222",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112395 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112396",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:9b6bcf28-1281-5b3c-b8ab-e2525ae155f3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112396 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112397",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:4c72c354-d0b8-5ef3-b569-7638aa6add8b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112397 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112398",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:ae1e76f1-23b4-5e1c-8263-e78e3d10793a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112398 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112399",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:f164348f-5756-5804-b097-e8dab68a5790",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112399 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112400",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:15600eec-3759-5f27-b6dc-1206dea891fa",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112400 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112401",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:888630d5-1820-5e70-aeaa-7de46068624d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112401 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112402",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:65701ed4-b21e-5d11-8aea-6b8ab63fe5d7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112402 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112403",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:011f15df-29d6-5900-b1a3-8c061a959d71",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112403 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112404",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:9d4bd896-3f36-5ffe-8204-bd8704aaf025",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112404 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112405",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:98957239-091d-559a-b7c7-83564ee84a20",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112405 affects version 11.3.0.post6+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-112406",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:c669513d-3c61-54c4-9deb-fab109e68c4b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112406 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112891",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:015c86b7-87c1-516d-980f-ff7493229202",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112891 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112892",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:76f8f1d2-790c-582a-95a9-5f30690e92fd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112892 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112893",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:f3125266-a04e-562a-bb44-061cc503b6be",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112893 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112894",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:be525d79-e39d-5bee-805d-a60ca7fb7b6c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112894 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112895",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:8503a778-84d5-5a45-8d8f-03af9bf468a8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112895 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112896",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:1efb5fd6-ccbd-59ae-8807-880305965e36",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112896 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112897",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:227ce3f8-0754-5258-929a-705710102ed9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112897 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112898",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:a75beb05-821f-5666-9ab0-271e0a1f4c49",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112898 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112899",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:4c2e29a0-a16f-56d6-a3d1-f3c4492e7e63",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112899 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112900",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:051a2d4f-aa4b-5522-b5be-db0b2564ce9e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112900 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112901",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:702d8889-7833-51cd-8f4c-823bc127b923",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112901 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare."
      }
    },
    {
      "id": "CVE-2026-112902",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:6b41d8ac-a4b6-5685-bb7f-b4a7d1f39735",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-112902 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare."
      }
    },
    {
      "id": "CVE-2026-114501",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:b181637b-58a5-5504-ba39-c139642c9347",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-114501 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare."
      }
    },
    {
      "id": "CVE-2026-25990",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:e25772ce-da12-50de-90de-7e3f0b193a11",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-25990 is fixed in version 11.3.0.post6+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-40192",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:1193f723-365a-5b1e-afb9-a0343a1d8a30",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-40192 is fixed in version 11.3.0.post6+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-42308",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:ef295319-3b3c-5834-9ff8-93b47346dda1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42308 is fixed in version 11.3.0.post6+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-42309",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:487777b2-67c8-5a22-994d-511ce3927677",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42309 is fixed in version 11.3.0.post6+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-42310",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:6d9ef5ce-bc43-5c37-b42f-b43287e1ec75",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42310 is fixed in version 11.3.0.post6+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-42311",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:c31769fe-1e99-5907-8e80-036a3b8b82f3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42311 is fixed in version 11.3.0.post6+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-54058",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:d8cb099d-adf5-54ce-add3-04640086fc66",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54058 is fixed in version 11.3.0.post6+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-54059",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:8f1a68a0-ea77-5fc8-b0ca-6c6001580884",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54059 is fixed in version 11.3.0.post6+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-54060",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:bfdfb840-d692-5162-93e0-96132c77bbd5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54060 is fixed in version 11.3.0.post6+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-55379",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:73ab77e0-9c3f-515d-a25d-dbc41b80177c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-55379 is fixed in version 11.3.0.post6+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-55380",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:48ef438e-4c60-5d2e-a0bc-ff9f0b3eaedc",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-55380 is fixed in version 11.3.0.post6+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-55798",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:36cb793a-97d7-5969-9e64-0460d98e85f7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-55798 is fixed in version 11.3.0.post6+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-59197",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:5f836b71-ac8f-5cf0-81d7-d23c94fc7ced",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59197 is fixed in version 11.3.0.post6+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-59198",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:0354e99d-cdc8-5b86-aa82-bf702eeb10fa",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59198 is fixed in version 11.3.0.post6+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-59199",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:33f59c97-15bc-5cba-a314-bfa3a8dda3d9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59199 is fixed in version 11.3.0.post6+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-59200",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:55eeea3c-d680-5fb4-bfdf-26fc4283d789",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59200 is fixed in version 11.3.0.post6+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-59204",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:6d393d62-251a-5747-91cc-bad354eb59e8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59204 is fixed in version 11.3.0.post6+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-59205",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:4d21b6e4-bc10-5543-a3e9-cdc00226f612",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59205 is fixed in version 11.3.0.post6+tuxcare of pillow."
      }
    },
    {
      "id": "CVE-2026-96636",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:99343492-1cd2-55b5-9ed0-25092f8d49d8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-96636 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare."
      }
    },
    {
      "id": "CVE-2026-96637",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:1c9d1441-2b41-55f4-acad-4b58030d5f8d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-96637 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare."
      }
    },
    {
      "id": "CVE-2026-96638",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:b15b2718-4a94-5a8f-9077-45adb5770e83",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-96638 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare."
      }
    },
    {
      "id": "CVE-2026-96639",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:7d5024fd-63f8-5d65-8fcd-5d1e56eeca55",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-96639 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare."
      }
    },
    {
      "id": "CVE-2026-96640",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:59a0a60d-4dd9-53b4-97c3-c766f195a7a4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-96640 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare."
      }
    },
    {
      "id": "CVE-2026-96641",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:900cc086-466f-572f-a4bf-8c79d524223a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-96641 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare."
      }
    },
    {
      "id": "CVE-2026-96642",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:4a7ab9f3-d05a-55a4-a9ec-6c61e5a0d4dc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-96642 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare."
      }
    },
    {
      "id": "CVE-2026-96643",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:cf4ec077-9878-5255-a7a5-dd2f0fb781ce",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-96643 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare."
      }
    },
    {
      "id": "CVE-2026-96644",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:095ba3c8-0983-5c69-b0e4-0cdb0023bba1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-96644 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare."
      }
    },
    {
      "id": "CVE-2026-96778",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:d31449b5-3231-5e70-a9ce-4efd5b10ab03",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-96778 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare."
      }
    },
    {
      "id": "GHSA-4fx9-vc88-q2xc",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:2da47596-f357-589f-ac6e-1526e735b2b0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.3.0.post6+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin when processing truncated JPEG files) is NOT present in Pillow 11.3.0.post12+tuxcare. The fix was already included in the upstream Pillow 11.3.0 release before TuxCare onboarded it. The defense code at src/PIL/JpegImagePlugin.py:417-421 prevents infinite loops by tracking whether an EOF marker has already been returned via ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-78g4-xqwv-q3g8",
      "affects": [
        {
          "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:53bcf0a3-ecc8-5b60-a416-7abbbddc75b6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.3.0.post6+tuxcare of pillow. not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel...",
        "justification": "requires_dependency"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare"
    }
  ]
}