{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:29ffe600-e68b-5639-9975-638918b5d4c1",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "pyjwt",
      "purl": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare",
      "type": "library",
      "bom-ref": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare",
      "version": "2.10.1.post7+tuxcare",
      "pedigree": {
        "ancestors": [
          {
            "name": "pyjwt",
            "purl": "pkg:pypi/pyjwt@2.10.1",
            "type": "library",
            "version": "2.10.1"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-29217",
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:ee1237b9-2e45-5fce-8700-3a4b2527d769",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-29217 affects version 2.10.1.post7+tuxcare of pyjwt."
      }
    },
    {
      "id": "CVE-2025-45768",
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:f30b7cdc-9b58-53b6-adef-af465756458b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-45768 is fixed in version 2.10.1.post7+tuxcare of pyjwt."
      }
    },
    {
      "id": "CVE-2026-101917",
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:8816e1c7-685c-5509-bedf-e01e9fb669f6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-101917 is fixed in version 2.10.1.post7+tuxcare of pyjwt."
      }
    },
    {
      "id": "CVE-2026-101918",
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:87210c75-7e75-5204-9f52-13a4ea67b605",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-101918 is fixed in version 2.10.1.post7+tuxcare of pyjwt."
      }
    },
    {
      "id": "CVE-2026-102265",
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:8a9044ce-075a-5dce-b148-2c0bd5cac620",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-102265 affects version 2.10.1.post7+tuxcare of pyjwt."
      }
    },
    {
      "id": "CVE-2026-102266",
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:f5fbb649-5165-5877-983e-1918279e5121",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-102266 affects version 2.10.1.post7+tuxcare of pyjwt."
      }
    },
    {
      "id": "CVE-2026-102267",
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:5afc4610-f8a4-5010-b61a-5aad4b5a9462",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-102267 is fixed in version 2.10.1.post7+tuxcare of pyjwt."
      }
    },
    {
      "id": "CVE-2026-102268",
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:45a2c083-fde9-5e01-9d90-60a11fbea758",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-102268 is fixed in version 2.10.1.post7+tuxcare of pyjwt."
      }
    },
    {
      "id": "CVE-2026-102269",
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:c179c6be-74a8-57c9-975d-5551005948a6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-102269 is fixed in version 2.10.1.post7+tuxcare of pyjwt."
      }
    },
    {
      "id": "CVE-2026-102270",
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:e0089719-613d-5e00-a4fe-c0f2e545f912",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-102270 is fixed in version 2.10.1.post7+tuxcare of pyjwt."
      }
    },
    {
      "id": "CVE-2026-102271",
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:e54a23cf-e8a9-5dd6-aefd-3c4ec3566819",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-102271 is fixed in version 2.10.1.post7+tuxcare of pyjwt."
      }
    },
    {
      "id": "CVE-2026-102272",
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:c3690c7c-6167-5ea7-81a2-ea64a9a8f084",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-102272 affects version 2.10.1.post7+tuxcare of pyjwt."
      }
    },
    {
      "id": "CVE-2026-102273",
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:9cce7269-5c8a-574a-85b5-deb65c480798",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-102273 affects version 2.10.1.post7+tuxcare of pyjwt."
      }
    },
    {
      "id": "CVE-2026-102274",
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:663f5959-c962-5087-b4b9-cec6995aadb5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-102274 is fixed in version 2.10.1.post7+tuxcare of pyjwt."
      }
    },
    {
      "id": "CVE-2026-102275",
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:eae33fb2-fafc-5c2e-87a5-538a6f5bb38c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-102275 is fixed in version 2.10.1.post7+tuxcare of pyjwt."
      }
    },
    {
      "id": "CVE-2026-103001",
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:fa1d5cd8-6c7c-5ff2-acd6-0bb63dea927a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-103001 does not affect version 2.10.1.post7+tuxcare of pyjwt. not_affected \u2014 Target version PyJWT 2.10.1 is NOT AFFECTED by CVE-2026-103001. The vulnerability (mutation of caller's options dict) was fixed upstream in April 2022 via PR #743 (commit 3d4d822). Version 2.10.1 was released in November 2024 with this fix present (line 132: `options = dict(options or {})`). The vulnerability was later reintroduced by PR #1045 in March 2025, affecting versions 2.11.0+ including...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-32597",
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:96dd5f53-d93a-5df6-8724-e6cc41cfa034",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-32597 is fixed in version 2.10.1.post7+tuxcare of pyjwt."
      }
    },
    {
      "id": "CVE-2026-48522",
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:e96af406-0845-5c48-a11d-1afecefb8d96",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-48522 does not affect version 2.10.1.post7+tuxcare of pyjwt. already_fixed \u2014 CVE-2026-48522 describes PyJWKClient accepting non-HTTP(S) URI schemes (file://, ftp://, data:) which enables SSRF and token forgery. The target repository at version 2.10.1.post2+tuxcare (SHA 098e78a) already contains the exact defense recommended in the CVE. The fix was backported by TuxCare in commit afaaa88 as part of the PyJWT 2.13.0 security bundle. The same vulnerability reporter (Keijo ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-48523",
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:0d974c69-393f-5f27-8f31-410f13ab689b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-48523 is fixed in version 2.10.1.post7+tuxcare of pyjwt."
      }
    },
    {
      "id": "CVE-2026-48524",
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:8c565f2d-e492-50c4-8be1-209f3a19b487",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-48524 is fixed in version 2.10.1.post7+tuxcare of pyjwt."
      }
    },
    {
      "id": "CVE-2026-48525",
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:9ece32b4-0e00-5070-9410-b254515b3602",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-48525 is fixed in version 2.10.1.post7+tuxcare of pyjwt."
      }
    },
    {
      "id": "CVE-2026-48526",
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:18f5c3e3-1ef1-51bf-846f-757de7179cf2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-48526 is fixed in version 2.10.1.post7+tuxcare of pyjwt."
      }
    },
    {
      "id": "GHSA-pxh4-856f-4h89",
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:59ff33ed-533b-571d-9357-b1644d48bb59",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-pxh4-856f-4h89 is fixed in version 2.10.1.post7+tuxcare of pyjwt."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare"
    }
  ]
}