{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c946b644-f0a6-5f3d-ad12-93e7e5fe34bb", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "version": "8.4.0.post7+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@8.4.0", "type": "library", "version": "8.4.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-22815", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:a47ae00a-3849-5d3e-b198-74af42812d24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22815 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2022-22816", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:876bf499-9093-53a2-9bb3-878f41c7a10f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22816 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2022-22817", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:4cc50b94-01c4-554b-af23-3757a49dc86f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22817 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2022-24303", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:2f6f79ba-0269-52f6-a1c1-d0e4cfa30345", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-24303 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2022-45198", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:32695904-9b51-5078-901d-ae6a3c235b5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-45198 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2023-44271", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:baf34fc0-2f8d-51e5-b639-d0e3d6271afa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44271 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2023-4863", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:5ef6cd12-7561-54a7-aba1-4cfe890e9257", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-4863 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post10+tuxcare." } }, { "id": "CVE-2023-50447", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:f823a8d1-e9dc-5668-a39a-932e31538cb6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-50447 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2024-28219", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:07b162a3-94a8-52f9-a27b-b48d25af0325", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-28219 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2025-48379", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:ed224841-3aa4-5363-aee3-57b9504187f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48379 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:1c3c6ecc-d80e-5897-aae5-eb2c2dbf4272", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112390 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:d73eb7e9-5b1c-565b-bc91-4c800c889246", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:29a8d8e9-ccd2-571b-93d4-7e1b9be3d97c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112392 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:9adc4972-e2f9-59d8-95e0-add6da2ec438", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112393 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:f38c4f61-6697-5b48-947f-4caf1acbdd11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:862ad6de-e27d-51c2-a543-70a69971af82", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112395 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112396", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:e1dfdbda-0aed-5816-8d19-c23516319e16", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-112396 does not affect version 8.4.0.post7+tuxcare of pillow. not_affected \u2014 Version 8.4.0 is not affected by CVE-2026-112396. The vulnerability requires freeing the buffer before closing the TIFF handle, allowing TIFFClose to write to freed memory during flush. Version 8.4.0 has a different architecture than vulnerable versions: it has no separate cleanup function and calls TIFFClose BEFORE freeing data in all error paths (lines 979\u2192981, 996\u2192998, 1003\u21921022), preventing...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:de46062a-68d0-5aa9-843d-101bfe4b4846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112397 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:e41ebec1-9ec1-5a2d-bf74-a67f29a60a96", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:0f25d62d-4a7c-5abf-a559-98ba8f6eb828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112399 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112400", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:68652f42-f6a3-5d07-acb7-845dc91ddbbd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112400 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:703f8f3d-1084-5e6a-bf3a-8858cd278c0c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:9f7af947-7e0c-5372-92d1-13899a6c3b49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112402 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:6c6d7e76-d1af-5e3c-8e75-1a4ef0d9982b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112403 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:50f8be68-d85d-5493-a35f-a70cbcf0c1d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112404 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112405", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:0fc2b231-4953-5c6a-af96-00df71fd0fde", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112405 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:d47be018-f639-59ae-b038-eef353b98c35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112406 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112891", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:8beb8527-c26c-5a41-bba7-cae52a724023", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112891 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:b7858652-2fc9-5aa1-b15c-7d9227344b46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112892 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112893", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:0c65408b-e50b-51ae-a524-9059ee2ffb94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112893 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:0c183f3c-651f-5736-8945-d0d1bf1daf22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112894 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:d63340e7-1910-5a27-808c-5e9c7bcbff78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112895 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:45a71b6c-0b8e-514a-ba9b-70a0689f290d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112896 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:d90d5d22-d9c4-5b44-9c36-402f6149541b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112897 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112898", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:078aebed-3ab9-5b35-9b3f-c8d5a08f8b78", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-112898 does not affect version 8.4.0.post7+tuxcare of pillow. not_affected \u2014 Version 8.4.0 is NOT AFFECTED by CVE-2026-112898. The vulnerability was introduced in commit 54cb09d8b (first released in 9.1.0) and does not exist in version 8.4.0. The target version uses a fundamentally different palette architecture: it lacks the `palette->size` field entirely, and `ImagingPaletteCacheUpdate()` always loops 256 times (hardcoded `for (i = 0; i < 256; i++)`), not `palette->si...", "justification": "code_not_present" } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:ba740fcf-3686-54bd-a913-fb5be3c42f8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112899 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:2397b7a5-619f-5b2e-84a4-bf5fc1a5e0c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112900 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:dda99c02-3c38-51e2-b1f9-e3f4e86aa06a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:0bdbd3e1-bd68-5646-bb62-dd51bf17f6ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-114501", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:982b05d7-357b-553c-883a-e3facfa4aa10", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114501 does not affect version 8.4.0.post7+tuxcare of pillow. not_affected \u2014 CVE-2026-114501 affects Pillow's Arrow export functionality, which leaks uninitialized heap memory when PILLOW_ALIGNMENT > 1. However, the target version 8.4.0.post12+tuxcare does NOT contain Arrow export functionality. Arrow support was introduced in commit 5c76e7ec17813eefaa1fdd8948e0165ee644e11f and first appeared in version 11.2.1+. Version 8.4.0 predates this feature by several major relea...", "justification": "code_not_present" } }, { "id": "CVE-2026-25990", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:103f3b3f-cc7d-56d6-b63e-82ef38dcb83a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25990 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-40192", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:4f3d9c63-c99d-58b3-bd65-3ae4e652cd0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-40192 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:a9fab433-febd-58b0-a8d3-57b032c83c78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42308 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-42309", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:bdaf6de6-5ab7-5e8c-97a9-f2d17412f3db", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42309 does not affect version 8.4.0.post7+tuxcare of pillow. not_affected \u2014 The target Pillow version 8.4.0.post12+tuxcare is not affected by CVE-2026-42309. This vulnerability was introduced in Pillow 11.2.1 (commit 5ba72a9b5 \"Allow coords to be sequence of lists\", March 6, 2025) when recursive list handling was added to the assign_item_to_array function. The target version 8.4.0 predates this change and does not contain the vulnerable recursive unpacking code. In ver...", "justification": "code_not_present" } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:c6e91cfa-4c93-5180-84e4-23ee284352c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42310 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-42311", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:12d3df63-a4b9-5341-b33a-33afe346059c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42311 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:60ce1484-40f0-5fc4-b615-88ae79a40afc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:b123fecf-f288-5577-8e59-e0afc6a65c55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:af5e9d3d-f788-50a7-a5f4-301c05ed76c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:b8af8701-5e12-5606-b5d1-12348a7a5773", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:c62c3734-1981-5b75-987a-026fc4a52789", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55380 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:df152554-b512-5d22-8d6b-5eda2d884188", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:969e093b-8def-5f35-8742-f81098bc8372", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59197 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:425ddf28-3917-5e81-8c84-3d19ea4934de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59198 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:865096c2-b3b0-5ea8-8d43-acd1efab5569", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59199 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:7938e9c4-a0f8-504f-b772-bf2551c686a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59200 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:95e8a759-1809-5397-a971-34043f78b2cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59204 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:bc806118-fb54-57f8-b554-63938d241203", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59205 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:da8e7ec5-5011-52c2-b913-9fcab8e14d7e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:0f996722-1758-54ea-adfd-144a7ea0c656", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96637 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare." } }, { "id": "CVE-2026-96638", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:aba446f3-e4ed-59c6-879a-f28a6929bb26", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-96638 does not affect version 8.4.0.post7+tuxcare of pillow. not_affected \u2014 Pillow 8.4.0 does not support RLE-compressed BMP files at all. The vulnerable BmpRleDecoder class and its decode() method do not exist in this version. RLE8 and RLE4 compression support was added to Pillow in March 2022 (commit 0ace3fcd2), after version 8.4.0 was released in October 2021. When an RLE-compressed BMP file is opened in version 8.4.0, it is immediately rejected with \"Unsupported BM...", "justification": "code_not_present" } }, { "id": "CVE-2026-96639", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:85e38428-4609-5585-b20b-e1559a404e7b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96639 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:dbf70797-d811-5cc3-9ede-028b72947e94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96640 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:460a10ce-09a1-51ea-9d70-300d04bfbc6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:073dfe15-982d-570e-81c9-79ce42cae8e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96642 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare." } }, { "id": "CVE-2026-96643", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:f22d3c56-ffd2-5fcb-9a81-b5e0e5e8810a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96643 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:ae938905-b680-5660-b0cb-ca1dbc3e5621", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96644 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-96778", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:7d8d57a7-9d89-5b66-8e1e-a51066ebcf21", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96778 affects version 8.4.0.post7+tuxcare of pillow." } }, { "id": "GHSA-4fx9-vc88-q2xc", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:072b13f0-252b-51d5-a3cb-04c67b7b83de", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4fx9-vc88-q2xc is fixed in version 8.4.0.post7+tuxcare of pillow." } }, { "id": "GHSA-56pw-mpj4-fxww", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:1ad79a7c-da26-5ddd-b445-5b42baa781fb", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 8.4.0.post7+tuxcare." } }, { "id": "GHSA-78g4-xqwv-q3g8", "affects": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:99667765-e50a-5cd5-9a90-5d4df2ea92f9", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 8.4.0.post7+tuxcare of pillow." } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } ] }